@mega-yfue/eufy-sdk 0.2.0-beta.2 → 0.2.0-beta.20

package/dist/index.js

@@ -15,6 +15,7 @@ import { createCipheriv, createDecipheriv, createECDH, createHash, createHmac, r
 var P256 = "prime256v1";
 var EUFY_MEGA_LOCAL_KEY_HEX = "2500a7d5617812f9d52515b2c8f20a3d";
 var EUFYLIFE_LOCAL_KEY_HEX = "118c12c81e211149304bd70a0c071d01";
+var SOLIX_LOCAL_KEY_HEX = "e8ad18f61bbd3fbd52d5ed12d14d3b9c";
 var SERVER_STATIC_PUBLIC_KEY_HEX = "04c5c00c4f8d1197cc7c3167c52bf7acb054d722f0ef08dcd7e0883236e0d72a3868d9750cb47fa4619248f3d83f0f662671dadc6e2d31c2f41db0161651c7c076";
 function genId() {
   return randomBytes(16).toString("hex");
@@ -22,8 +23,11 @@ function genId() {
 function nowSec() {
   return Math.floor(Date.now() / 1e3).toString();
 }
+function md5Hex(input) {
+  return createHash("md5").update(input, "utf-8").digest("hex");
+}
 function gtoken(userId) {
-  return createHash("md5").update(userId, "utf-8").digest("hex");
+  return md5Hex(userId);
 }
 function aesKey(shareKeyHex) {
   return Buffer.from(shareKeyHex, "hex").subarray(0, 16);
@@ -142,14 +146,17 @@ var FileSessionStore = class {
     }
   }
 };
-function isSessionValid(s, skewSec = 300) {
-  if (!s?.authToken || !s.shareKey || !s.keyIdent)
-    return false;
-  if (s.tokenExpiresAt && s.tokenExpiresAt > 0) {
-    return Math.floor(Date.now() / 1e3) < s.tokenExpiresAt - skewSec;
+function tokenNotExpired(tokenExpiresAt, skewSec = 300) {
+  if (tokenExpiresAt && tokenExpiresAt > 0) {
+    return Math.floor(Date.now() / 1e3) < tokenExpiresAt - skewSec;
   }
   return true;
 }
+function isSessionValid(s, skewSec = 300) {
+  if (!s?.authToken || !s.shareKey || !s.keyIdent || !s.accountUserId)
+    return false;
+  return tokenNotExpired(s.tokenExpiresAt, skewSec);
+}
 
 // dist/core/logger.js
 var noopLogger = {
@@ -210,18 +217,33 @@ BLOCKED_ADDRESSES.addAddress("::1", "ipv6");
 BLOCKED_ADDRESSES.addSubnet("fc00::", 7, "ipv6");
 BLOCKED_ADDRESSES.addSubnet("fe80::", 10, "ipv6");
 var MediaDownloadError = class extends Error {
+  mediaFailure;
+  status;
+  constructor(message, mediaFailure, status) {
+    super(message);
+    this.name = "MediaDownloadError";
+    this.mediaFailure = mediaFailure;
+    if (status !== void 0)
+      this.status = status;
+  }
 };
+function mediaFailureError(message, reason, cause) {
+  const error = new MediaDownloadError(message, reason);
+  if (cause !== void 0)
+    error.cause = cause;
+  return error;
+}
 var MediaDownloadAuthenticationError = class extends Error {
 };
-function allowedMediaUrl(value, hostPattern) {
+function allowedMediaUrl(value, hostPattern, reason) {
   let url;
   try {
     url = new URL(value);
   } catch {
-    throw new MediaDownloadError("Media download rejected");
+    throw new MediaDownloadError("Media download rejected", reason);
   }
   if (url.protocol !== "https:" || url.username !== "" || url.password !== "" || url.port !== "" || isIP(url.hostname) !== 0 || !hostPattern.test(url.hostname)) {
-    throw new MediaDownloadError("Media download rejected");
+    throw new MediaDownloadError("Media download rejected", reason);
   }
   return url;
 }
@@ -236,7 +258,7 @@ async function assertPublicResolution(url, resolveHost2, signal) {
   try {
     addresses = await Promise.race([resolveHost2(url.hostname), aborted]);
   } catch {
-    throw new MediaDownloadError("Media download rejected");
+    throw new MediaDownloadError("Media download rejected", "address-not-public");
   } finally {
     signal.removeEventListener("abort", onAbort);
   }
@@ -244,14 +266,14 @@ async function assertPublicResolution(url, resolveHost2, signal) {
     const type = family === 6 ? "ipv6" : family === 4 ? "ipv4" : void 0;
     return type === void 0 || BLOCKED_ADDRESSES.check(address, type);
   })) {
-    throw new MediaDownloadError("Media download rejected");
+    throw new MediaDownloadError("Media download rejected", "address-not-public");
   }
 }
 var resolveHost = (hostname) => lookup(hostname, { all: true, verbatim: true });
 async function readMediaBody(response) {
   const contentLength = response.headers.get("content-length");
   if (contentLength && /^\d+$/.test(contentLength) && BigInt(contentLength) > BigInt(MEDIA_DOWNLOAD_MAX_BYTES)) {
-    throw new MediaDownloadError("Media download rejected");
+    throw new MediaDownloadError("Media download rejected", "too-large");
   }
   if (!response.body)
     return Buffer.alloc(0);
@@ -265,14 +287,14 @@ async function readMediaBody(response) {
     bytes2 += value.byteLength;
     if (bytes2 > MEDIA_DOWNLOAD_MAX_BYTES) {
       void reader2.cancel().catch(() => void 0);
-      throw new MediaDownloadError("Media download rejected");
+      throw new MediaDownloadError("Media download rejected", "too-large");
     }
     chunks.push(value);
   }
   return Buffer.concat(chunks, bytes2);
 }
 async function downloadMediaResource(url, authenticatedHeaders, fetchImpl = fetch, resolver = resolveHost) {
-  const original = allowedMediaUrl(url, EUFY_MEDIA_HOST);
+  const original = allowedMediaUrl(url, EUFY_MEDIA_HOST, "url-not-allowed");
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), MEDIA_DOWNLOAD_TIMEOUT_MS);
   try {
@@ -285,31 +307,33 @@ async function downloadMediaResource(url, authenticatedHeaders, fetchImpl = fetc
     if (originalResponse.status >= 300 && originalResponse.status < 400) {
       const location = originalResponse.headers.get("location");
       if (!location)
-        throw new MediaDownloadError("Media download rejected");
-      const target = allowedMediaUrl(location, EUFY_OBJECT_HOST);
+        throw new MediaDownloadError("Media download rejected", "redirect-not-allowed");
+      const target = allowedMediaUrl(location, EUFY_OBJECT_HOST, "redirect-not-allowed");
       await assertPublicResolution(target, resolver, controller.signal);
       const redirectedResponse = await fetchImpl(target, { redirect: "manual", signal: controller.signal });
       if (redirectedResponse.status >= 300 && redirectedResponse.status < 400) {
-        throw new MediaDownloadError("Media download rejected");
+        throw new MediaDownloadError("Media download rejected", "redirect-not-allowed");
+      }
+      if (redirectedResponse.status !== 200) {
+        throw new MediaDownloadError("Media download failed", "http-status", redirectedResponse.status);
       }
-      if (redirectedResponse.status !== 200)
-        throw new MediaDownloadError("Media download failed");
       return await readMediaBody(redirectedResponse);
     }
     if (originalResponse.status === 401 || originalResponse.status === 403) {
       throw new MediaDownloadAuthenticationError("Media authentication failed");
     }
-    if (originalResponse.status !== 200)
-      throw new MediaDownloadError("Media download failed");
+    if (originalResponse.status !== 200) {
+      throw new MediaDownloadError("Media download failed", "http-status", originalResponse.status);
+    }
     return await readMediaBody(originalResponse);
   } catch (error) {
     if (controller.signal.aborted)
-      throw new MediaDownloadError("Media download timed out");
+      throw new MediaDownloadError("Media download timed out", "timeout");
     if (error instanceof MediaDownloadAuthenticationError)
       throw error;
     if (error instanceof MediaDownloadError)
       throw error;
-    throw new MediaDownloadError("Media download failed");
+    throw new MediaDownloadError("Media download failed", "network");
   } finally {
     clearTimeout(timeout);
   }
@@ -368,8 +392,228 @@ function randomUserAgent(seed, model) {
 // dist/transport/http/decodeImageV1.js
 import { createDecipheriv as createDecipheriv2, createHash as createHash2 } from "node:crypto";
 
+// dist/transport/http/jpeg-scan.js
+var DHT = 196;
+var SOS = 218;
+var DRI = 221;
+var RST_FIRST = 208;
+var RST_LAST = 215;
+var LUMA_SAMPLING = { 0: [1, 1], 1: [2, 1], 2: [2, 2] };
+var ScanEnd = class extends Error {
+};
+function readHuffmanTables(segment, into) {
+  const end = 2 + (segment[2] << 8 | segment[3]);
+  let at = 4;
+  while (at < end) {
+    const id = segment[at];
+    const counts = segment.subarray(at + 1, at + 17);
+    let total = 0;
+    for (const count2 of counts)
+      total += count2;
+    const values = segment.slice(at + 17, at + 17 + total);
+    const minCode = new Int32Array(17);
+    const maxCode = new Int32Array(17).fill(-1);
+    const valPtr = new Int32Array(17);
+    let code = 0;
+    let index = 0;
+    for (let length = 1; length <= 16; length++) {
+      const count2 = counts[length - 1];
+      if (count2 > 0) {
+        valPtr[length] = index;
+        minCode[length] = code;
+        code += count2;
+        index += count2;
+        maxCode[length] = code - 1;
+      }
+      code <<= 1;
+    }
+    into.set(id, { minCode, maxCode, valPtr, values });
+    at += 17 + total;
+  }
+}
+var BitReader = class {
+  /** Byte offset of the next byte to read. */
+  position;
+  bits = 0;
+  count = 0;
+  /** Set when the reader stepped over a restart marker — the caller resets its DC predictors. */
+  restarted = false;
+  data;
+  constructor(data, start) {
+    this.data = data;
+    this.position = start;
+  }
+  /** The offset the last whole byte ended at — what "how much of the scan did this consume" reads. */
+  get consumed() {
+    return this.position;
+  }
+  readBit() {
+    if (this.count === 0) {
+      if (this.position >= this.data.length)
+        throw new ScanEnd("out of data");
+      let byte = this.data[this.position++];
+      if (byte === 255) {
+        const next = this.data[this.position];
+        if (next === 0) {
+          this.position++;
+        } else if (next !== void 0 && next >= RST_FIRST && next <= RST_LAST) {
+          this.position++;
+          this.restarted = true;
+          if (this.position >= this.data.length)
+            throw new ScanEnd("out of data");
+          byte = this.data[this.position++];
+          if (byte === 255)
+            throw new ScanEnd("marker after restart");
+        } else {
+          this.position--;
+          throw new ScanEnd("marker");
+        }
+      }
+      this.bits = byte;
+      this.count = 8;
+    }
+    this.count--;
+    return this.bits >> this.count & 1;
+  }
+  /** Read `length` bits, most significant first. */
+  readBits(length) {
+    let value = 0;
+    for (let i = 0; i < length; i++)
+      value = value << 1 | this.readBit();
+    return value;
+  }
+  /** Drop the current byte's remaining bits — what a restart interval boundary does. */
+  align() {
+    this.count = 0;
+  }
+};
+function decodeHuffman(reader2, table) {
+  let code = reader2.readBit();
+  for (let length = 1; length <= 16; length++) {
+    if (table.maxCode[length] >= 0 && code <= table.maxCode[length]) {
+      return table.values[table.valPtr[length] + code - table.minCode[length]];
+    }
+    code = code << 1 | reader2.readBit();
+  }
+  throw new ScanEnd("no huffman code of any length");
+}
+function extend(value, length) {
+  return value < 1 << length - 1 ? value - (1 << length) + 1 : value;
+}
+function decodeBlock(reader2, component) {
+  const dcLength = decodeHuffman(reader2, component.dc);
+  if (dcLength > 16)
+    throw new ScanEnd("dc magnitude out of range");
+  component.pred += dcLength === 0 ? 0 : extend(reader2.readBits(dcLength), dcLength);
+  let k = 1;
+  while (k < 64) {
+    const rs = decodeHuffman(reader2, component.ac);
+    const size = rs & 15;
+    const run = rs >> 4;
+    if (size === 0) {
+      if (run !== 15)
+        break;
+      k += 16;
+    } else {
+      k += run;
+      if (k > 63)
+        throw new ScanEnd("ac coefficient index out of range");
+      reader2.readBits(size);
+      k++;
+    }
+  }
+  return component.pred;
+}
+function scanEntropy(tail, subsampling, extraTables) {
+  const tables = /* @__PURE__ */ new Map();
+  for (const segment of extraTables)
+    readHuffmanTables(segment, tables);
+  let at = 0;
+  let restartInterval = 0;
+  let scanStart = -1;
+  let assignments = [];
+  while (at + 3 < tail.length) {
+    if (tail[at] !== 255)
+      return null;
+    const marker = tail[at + 1];
+    const length = tail[at + 2] << 8 | tail[at + 3];
+    if (marker === DHT) {
+      readHuffmanTables(tail.subarray(at, at + 2 + length), tables);
+    } else if (marker === DRI) {
+      restartInterval = tail[at + 4] << 8 | tail[at + 5];
+    } else if (marker === SOS) {
+      const count2 = tail[at + 4];
+      assignments = [];
+      for (let i = 0; i < count2; i++) {
+        const id = tail[at + 5 + i * 2];
+        const tableByte = tail[at + 6 + i * 2];
+        assignments.push({ id, dc: tableByte >> 4, ac: tableByte & 15 });
+      }
+      scanStart = at + 2 + length;
+      break;
+    }
+    at += 2 + length;
+  }
+  if (scanStart < 0 || assignments.length !== 3)
+    return null;
+  const [lumaH, lumaV] = LUMA_SAMPLING[subsampling] ?? LUMA_SAMPLING[0];
+  const components = [];
+  for (const [index, assignment] of assignments.entries()) {
+    const dc = tables.get(assignment.dc);
+    const ac = tables.get(16 | assignment.ac);
+    if (!dc || !ac)
+      return null;
+    components.push({ h: index === 0 ? lumaH : 1, v: index === 0 ? lumaV : 1, dc, ac, pred: 0 });
+  }
+  const reader2 = new BitReader(tail, scanStart);
+  let luma = new Int32Array(1024);
+  const lumaBlocks = lumaH * lumaV;
+  let mcus = 0;
+  let consumed = reader2.consumed;
+  let complete = false;
+  try {
+    for (; ; ) {
+      if (restartInterval > 0 && mcus > 0 && mcus % restartInterval === 0) {
+        reader2.align();
+        for (const component of components)
+          component.pred = 0;
+      }
+      if (reader2.restarted) {
+        reader2.restarted = false;
+        for (const component of components)
+          component.pred = 0;
+      }
+      let lumaSum = 0;
+      for (const component of components) {
+        for (let block = 0; block < component.h * component.v; block++) {
+          const dc = decodeBlock(reader2, component);
+          if (component === components[0])
+            lumaSum += dc;
+        }
+      }
+      if (mcus === luma.length) {
+        const grown = new Int32Array(luma.length * 2);
+        grown.set(luma);
+        luma = grown;
+      }
+      luma[mcus] = Math.round(lumaSum / lumaBlocks);
+      mcus++;
+      consumed = reader2.consumed;
+      if (consumed >= tail.length) {
+        complete = true;
+        break;
+      }
+    }
+  } catch (error) {
+    if (!(error instanceof ScanEnd))
+      throw error;
+    complete = tail.length - consumed <= 2;
+  }
+  return { mcus, luma: luma.subarray(0, mcus), complete };
+}
+
 // dist/transport/http/decodeImageV2.js
-import { decode as jpegDecode, encode as jpegEncode } from "jpeg-js";
+import { decode as jpegDecode } from "jpeg-js";
 var V2_PREFIX = "v2_eufysecurity:";
 var DC_CHROMA = Buffer.from([255, 196, 0, 31, 1]);
 var ZIGZAG = [
@@ -575,35 +819,6 @@ var DHT_AC_LUMA = Buffer.from("ffc400b5100002010303020403050504040000017d0102030
 var SOI = Buffer.from([255, 216]);
 var APP0 = Buffer.from("ffe000104a46494600010100000100010000", "hex");
 var MCU = { 0: [8, 8], 1: [16, 8], 2: [16, 16] };
-var LADDER = [
-  [160, 90],
-  [240, 135],
-  [256, 144],
-  [320, 180],
-  [384, 216],
-  [400, 225],
-  [480, 270],
-  [512, 288],
-  [576, 324],
-  [640, 360],
-  [704, 396],
-  [768, 432],
-  [848, 480],
-  [960, 540],
-  [1024, 576],
-  [1280, 720],
-  [1600, 900],
-  [1920, 1080],
-  [176, 144],
-  [320, 240],
-  [352, 288],
-  [480, 360],
-  [640, 480],
-  [800, 600],
-  [1024, 768],
-  [256, 480],
-  [320, 384]
-];
 function scaleQuant(base, quality) {
   const factor = quality < 50 ? Math.floor(5e3 / quality) : 200 - quality * 2;
   return base.map((v) => Math.min(255, Math.max(1, Math.floor((v * factor + 50) / 100))));
@@ -640,7 +855,7 @@ function sofSegment(width, height, subsampling) {
     1
   ]);
 }
-function buildHeader(width, height, subsampling, quality = 85) {
+function buildHeader(width, height, subsampling, quality) {
   return Buffer.concat([
     SOI,
     APP0,
@@ -651,99 +866,107 @@ function buildHeader(width, height, subsampling, quality = 85) {
     DHT_AC_LUMA
   ]);
 }
-function decodeCandidate(tail, width, height, subsampling) {
+var PROBE_MEMORY_MB = 24;
+function decodeSpliced(header, tail) {
   try {
-    const jpeg = Buffer.concat([buildHeader(width, height, subsampling), tail]);
-    return jpegDecode(jpeg, { useTArray: true, maxMemoryUsageInMB: 128 });
+    return jpegDecode(Buffer.concat([header, tail]), { useTArray: true, maxMemoryUsageInMB: PROBE_MEMORY_MB });
   } catch {
     return null;
   }
 }
-function colorSpread(img) {
-  const { width, height, data } = img;
-  let sum = 0;
-  let count2 = 0;
-  for (let i = 0; i < width * height; i += 37) {
-    const p = i * 4;
-    const r = data[p];
-    const g = data[p + 1];
-    const b = data[p + 2];
-    sum += Math.abs(r - g) + Math.abs(g - b) + Math.abs(b - r);
-    count2++;
-  }
-  return count2 ? sum / count2 : Number.POSITIVE_INFINITY;
-}
-function rowShear(img, rows) {
-  const { width, data } = img;
-  let sum = 0;
-  let count2 = 0;
-  for (let y = 1; y < rows; y++) {
-    for (let x = 0; x < width; x += 4) {
-      sum += Math.abs(data[(y * width + x) * 4] - data[((y - 1) * width + x) * 4]);
-      count2++;
-    }
+var REFERENCE_QUALITY = 85;
+var MAX_STRETCH = 8;
+var CUTOFF_PERCENT = 0.5;
+function trimmedRange(data, channel, total, cutoff) {
+  const hist = new Array(256).fill(0);
+  for (let i = 0; i < total; i++)
+    hist[data[i * 4 + channel]]++;
+  let remaining = Math.floor(total * cutoff / 100);
+  let lo = 0;
+  while (lo < 255 && remaining > 0) {
+    if (remaining < hist[lo])
+      break;
+    remaining -= hist[lo];
+    lo++;
+  }
+  remaining = Math.floor(total * cutoff / 100);
+  let hi = 255;
+  while (hi > 0 && remaining > 0) {
+    if (remaining < hist[hi])
+      break;
+    remaining -= hist[hi];
+    hi--;
   }
-  return count2 ? sum / count2 : Number.POSITIVE_INFINITY;
+  return { lo, hi };
 }
-function autoContrast(data, width, height, cutoff = 0.5) {
-  const total = width * height;
+function contrastScale(img, cutoff = CUTOFF_PERCENT) {
+  const total = img.width * img.height;
+  if (total === 0)
+    return 1;
+  let stretch = Number.POSITIVE_INFINITY;
   for (let channel = 0; channel < 3; channel++) {
-    const hist = new Array(256).fill(0);
-    for (let i = 0; i < total; i++)
-      hist[data[i * 4 + channel]]++;
-    let remaining = Math.floor(total * cutoff / 100);
-    for (let bin = 0; bin < 256 && remaining > 0; bin++) {
-      if (remaining > hist[bin]) {
-        remaining -= hist[bin];
-        hist[bin] = 0;
-      } else {
-        hist[bin] -= remaining;
-        remaining = 0;
-      }
-    }
-    remaining = Math.floor(total * cutoff / 100);
-    for (let bin = 255; bin >= 0 && remaining > 0; bin--) {
-      if (remaining > hist[bin]) {
-        remaining -= hist[bin];
-        hist[bin] = 0;
-      } else {
-        hist[bin] -= remaining;
-        remaining = 0;
-      }
-    }
-    let lo = 0;
-    while (lo < 256 && hist[lo] === 0)
-      lo++;
-    let hi = 255;
-    while (hi >= 0 && hist[hi] === 0)
-      hi--;
+    const { lo, hi } = trimmedRange(img.data, channel, total, cutoff);
     if (hi <= lo)
       continue;
-    const scale = 255 / (hi - lo);
-    const offset = -lo * scale;
-    const lut = new Uint8Array(256);
-    for (let v = 0; v < 256; v++)
-      lut[v] = Math.min(255, Math.max(0, Math.trunc(v * scale + offset)));
-    for (let i = 0; i < total; i++)
-      data[i * 4 + channel] = lut[data[i * 4 + channel]];
-  }
-}
-function maxHeight(tail, width, subsampling, seed) {
-  const mcuHeight = MCU[subsampling][1];
-  let height = Math.max(mcuHeight, Math.round(seed / mcuHeight) * mcuHeight);
-  if (!decodeCandidate(tail, width, height, subsampling)) {
-    while (height > mcuHeight && !decodeCandidate(tail, width, height, subsampling))
-      height -= mcuHeight;
-  } else {
-    while (height < 4096 && decodeCandidate(tail, width, height + mcuHeight, subsampling))
-      height += mcuHeight;
-  }
-  return height;
-}
-function ladderByMcuCount(subsampling) {
-  const [mcuWidth, mcuHeight] = MCU[subsampling];
-  const mcus = ([width, height]) => width / mcuWidth * (height / mcuHeight);
-  return [...LADDER].sort((a, b) => mcus(a) - mcus(b));
+    if (lo < 128)
+      stretch = Math.min(stretch, 128 / (128 - lo));
+    if (hi > 128)
+      stretch = Math.min(stretch, 127 / (hi - 128));
+  }
+  if (!Number.isFinite(stretch))
+    return 1;
+  return Math.min(MAX_STRETCH, Math.max(1, stretch));
+}
+function qualityForStretch(stretch) {
+  const referenceFactor = REFERENCE_QUALITY < 50 ? Math.floor(5e3 / REFERENCE_QUALITY) : 200 - REFERENCE_QUALITY * 2;
+  const factor = referenceFactor * stretch;
+  const quality = factor <= 100 ? (200 - factor) / 2 : 5e3 / factor;
+  return Math.min(99, Math.max(1, Math.round(quality)));
+}
+var MAX_EDGE = 4096;
+var MIN_ASPECT = 0.4;
+var MAX_ASPECT = 4;
+function mcuRowShear(luma, mcuWidth, mcuHeight) {
+  if (mcuHeight < 2)
+    return Number.POSITIVE_INFINITY;
+  let sum = 0;
+  for (let y = 1; y < mcuHeight; y++) {
+    for (let x = 0; x < mcuWidth; x++)
+      sum += Math.abs(luma[y * mcuWidth + x] - luma[(y - 1) * mcuWidth + x]);
+  }
+  return sum / (mcuWidth * (mcuHeight - 1));
+}
+function bestGeometry(luma, mcus, subsampling) {
+  const [mcuPixelWidth, mcuPixelHeight] = MCU[subsampling];
+  let best = null;
+  for (let mcuWidth = 1; mcuWidth <= mcus; mcuWidth++) {
+    if (mcus % mcuWidth !== 0)
+      continue;
+    const mcuHeight = mcus / mcuWidth;
+    const width = mcuWidth * mcuPixelWidth;
+    const height = mcuHeight * mcuPixelHeight;
+    if (width > MAX_EDGE || height > MAX_EDGE)
+      continue;
+    const aspect = width / height;
+    if (aspect < MIN_ASPECT || aspect > MAX_ASPECT)
+      continue;
+    const shear = mcuRowShear(luma, mcuWidth, mcuHeight);
+    if (!best || shear < best.shear)
+      best = { subsampling, width, height, shear };
+  }
+  return best;
+}
+function findGeometry(tail) {
+  let best = null;
+  for (const subsampling of [0, 1, 2]) {
+    const scan = scanEntropy(tail, subsampling, [DHT_DC_LUMA, DHT_AC_LUMA]);
+    if (!scan?.complete || scan.mcus < 1)
+      continue;
+    const geometry = bestGeometry(scan.luma, scan.mcus, subsampling);
+    if (geometry && (!best || geometry.shear < best.shear))
+      best = geometry;
+  }
+  return best;
 }
 function isV2Image(data) {
   return data.length >= V2_PREFIX.length && data.subarray(0, V2_PREFIX.length).toString("latin1") === V2_PREFIX;
@@ -755,53 +978,17 @@ function decodeImageV2(data) {
   if (cut < 0)
     return null;
   const tail = data.subarray(cut);
-  let best = null;
-  for (const subsampling2 of [2, 0, 1]) {
-    let filled = null;
-    for (const [width2, height2] of ladderByMcuCount(subsampling2)) {
-      const img2 = decodeCandidate(tail, width2, height2, subsampling2);
-      if (!img2)
-        break;
-      if (!filled || width2 * height2 > filled.width * filled.height)
-        filled = { width: width2, height: height2, img: img2 };
-    }
-    if (!filled)
-      continue;
-    const spread = colorSpread(filled.img);
-    if (!best || spread < best.spread)
-      best = { spread, subsampling: subsampling2, width: filled.width, height: filled.height };
-  }
-  if (!best)
+  const geometry = findGeometry(tail);
+  if (!geometry)
     return null;
-  const { subsampling, width: coarseWidth } = best;
-  const [mcuWidth, mcuHeight] = MCU[subsampling];
-  const coarseHeight = maxHeight(tail, coarseWidth, subsampling, best.height);
-  const totalMcus = coarseWidth / mcuWidth * (coarseHeight / mcuHeight);
-  let width = coarseWidth;
-  let height = coarseHeight;
-  let bestShear = Number.POSITIVE_INFINITY;
-  const lowWidth = Math.max(mcuWidth * 4, Math.round(coarseWidth * 0.75 / mcuWidth) * mcuWidth);
-  const highWidth = Math.round(coarseWidth * 1.25 / mcuWidth) * mcuWidth;
-  for (let candidateWidth = lowWidth; candidateWidth <= highWidth; candidateWidth += mcuWidth) {
-    const candidateHeight = Math.floor(totalMcus / (candidateWidth / mcuWidth)) * mcuHeight;
-    if (candidateHeight < mcuHeight)
-      continue;
-    const img2 = decodeCandidate(tail, candidateWidth, candidateHeight, subsampling);
-    if (!img2)
-      continue;
-    const shear = rowShear(img2, candidateHeight);
-    if (shear < bestShear) {
-      bestShear = shear;
-      width = candidateWidth;
-      height = candidateHeight;
-    }
-  }
-  height = maxHeight(tail, width, subsampling, height);
-  const img = decodeCandidate(tail, width, height, subsampling);
-  if (!img)
+  const { width, height, subsampling } = geometry;
+  const reference = buildHeader(width, height, subsampling, REFERENCE_QUALITY);
+  const probe = decodeSpliced(reference, tail);
+  if (!probe)
     return null;
-  autoContrast(img.data, img.width, img.height);
-  return Buffer.from(jpegEncode({ data: img.data, width: img.width, height: img.height }, 90).data);
+  const stretch = contrastScale(probe);
+  const header = stretch > 1.01 ? buildHeader(width, height, subsampling, qualityForStretch(stretch)) : reference;
+  return Buffer.concat([header, tail]);
 }
 
 // dist/transport/http/decodeImageV1.js
@@ -948,7 +1135,7 @@ var REAUTH_HOLD_OFF_CAP_MS = 30 * 6e4;
 var REAUTH_STABLE_MS = 10 * 6e4;
 var CONTENDED_SESSION_HINT = "another client may be signed in with the same account and device identity, and each login displaces the other's session; give each client its own openudid";
 function tokenRejected(code, msg) {
-  return code === EufyCloudErrorCode.SESSION_KICKED || /user_id is empty|invalid.*token|token.*(expired|error|not exist)|kicked|(?:token|session).*does not exist|unauthor/i.test(msg ?? "");
+  return code === EufyCloudErrorCode.SESSION_KICKED || /user_id is empty|invalid[^,]*\btoken\b|\btoken\b[^,]*(expired|error|not exist)|kicked|(?:\btoken\b|\bsession\b)[^,]*does not exist|unauthor/i.test(msg ?? "");
 }
 function withoutTokenEcho(text2) {
   return text2.replace(/token\s*[=:]\s*"?[A-Za-z0-9._-]{8,}"?/gi, "token = <redacted>");
@@ -960,6 +1147,13 @@ var MegaHttpClient = class {
   sessionKey;
   /** Per-host ECDH session keys for non-mega gateways (e.g. eufylife) keyed by host. */
   sessionKeys = /* @__PURE__ */ new Map();
+  /**
+   * The held credential. `userId` is the login reply's `ap_cloud_user_id` where it has one — the Anker
+   * Passport cloud's id — while `accountUserId` is the eufy account's own `user_id`.
+   *
+   * The `gtoken` header is hashed from `accountUserId`: that is the id the gateway recomputes the header
+   * from, rejecting a disagreement with `"gtoken not equal userid error"`.
+   */
   auth_;
   /** captcha_id of an in-flight challenge, held between login() and solveCaptcha(). */
   pendingCaptchaId;
@@ -1025,7 +1219,12 @@ var MegaHttpClient = class {
     if (!isSessionValid(saved) || !saved)
       return void 0;
     this.region = saved.region;
-    this.auth_ = { userId: saved.userId, authToken: saved.authToken, geoKey: saved.geoKey };
+    this.auth_ = {
+      userId: saved.userId,
+      accountUserId: saved.accountUserId,
+      authToken: saved.authToken,
+      geoKey: saved.geoKey
+    };
     this.tokenExpiresAt = saved.tokenExpiresAt;
     this.sessionKey = {
       keyIdent: saved.keyIdent,
@@ -1045,12 +1244,20 @@ var MegaHttpClient = class {
     return this.region;
   }
   /**
-   * The logged-in account's display name — the login email's local-part (e.g. `someone+tag` for
-   * `someone+tag@example.com`). This is the string the app writes into the ff09 command's acting
-   * "username" field (verified against a captured T8531 unlock frame). Falls back to the whole email
-   * if it has no `@`.
+   * The name commands attribute themselves to — {@link MegaClientConfig.accountName} when the config
+   * pins one (trimmed; blank counts as unset), otherwise the logged-in account's display name, which
+   * is the login email's local-part (e.g. `someone+tag` for `someone+tag@example.com`) and falls back
+   * to the whole email if it has no `@`.
+   *
+   * The local-part is the string the app writes into the ff09 command's acting "username" field
+   * (verified against a captured T8531 unlock frame), so it is the faithful default. An override is a
+   * different LABEL for the same account, not a different identity: the session authenticates on the
+   * token and the device record's member ids, neither of which this touches.
    */
   get accountName() {
+    const pinned = this.cfg.accountName?.trim();
+    if (pinned)
+      return pinned;
     const email = this.cfg.email ?? "";
     const at = email.indexOf("@");
     return at > 0 ? email.slice(0, at) : email;
@@ -1088,7 +1295,16 @@ var MegaHttpClient = class {
     };
   }
   /**
-   * The account-credential headers every authed call carries — `x-auth-token` + `gtoken` (`md5(userId)`).
+   * The id `gtoken` is hashed from — the account's own `user_id`, which is what the gateway recomputes the
+   * header from. One place so the two header paths cannot drift on which of the session's ids that is.
+   *
+   * Call only where `auth_` is already established; every header path guards it.
+   */
+  gtokenUserId() {
+    return this.auth_.accountUserId ?? this.auth_.userId;
+  }
+  /**
+   * The account-credential headers every authed call carries — `x-auth-token` + `gtoken`.
    * One place so the signed path, the key-exchange and the bearer path can't drift on what "authed" means.
    */
   authTokenHeaders() {
@@ -1097,7 +1313,7 @@ var MegaHttpClient = class {
     return {
       "x-auth-token": this.auth_.authToken,
       authorization: this.auth_.authToken,
-      gtoken: gtoken(this.auth_.userId)
+      gtoken: gtoken(this.gtokenUserId())
     };
   }
   /**
@@ -1401,7 +1617,7 @@ var MegaHttpClient = class {
     try {
       return await downloadMediaResource(url, {
         "x-auth-token": this.auth_.authToken,
-        gtoken: gtoken(this.auth_.userId),
+        gtoken: gtoken(this.gtokenUserId()),
         "app-name": "eufy_mega",
         "model-type": "PHONE",
         "user-agent": this.mediaUserAgent
@@ -1413,9 +1629,20 @@ var MegaHttpClient = class {
       throw error;
     }
   }
-  /** Download push image bytes and decrypt a recognized v1 wrapper when its device key input is available. */
+  /**
+   * Download push image bytes and decrypt a recognized v1 wrapper when its device key input is available.
+   *
+   * A decoder throw is tagged `decode-failed`: to anything downstream, the difference between "the
+   * bytes never arrived" and "the bytes arrived and the wrapper would not decrypt" is the difference
+   * between a network problem and a key problem, and one of them is this SDK's to fix.
+   */
   async downloadImage(url, p2pDid) {
-    return normalizePushImage(await this.downloadMedia(url), p2pDid);
+    const data = await this.downloadMedia(url);
+    try {
+      return normalizePushImage(data, p2pDid);
+    } catch (error) {
+      throw mediaFailureError("Push image could not be decoded", "decode-failed", error);
+    }
   }
   /** The security-app data host for this region (face recognition, media, etc.). */
   securityAppHost() {
@@ -1692,17 +1919,19 @@ var MegaHttpClient = class {
     {
       const cap = Object.keys(res).filter((k) => /captcha|answer|picture|image|fa_/i.test(k));
       this.logger.debug("[mega] login resp keys:", Object.keys(res).join(","));
+      this.logger.debug("[mega] ids agree:", res.ap_cloud_user_id === res.user_id);
       if (cap.length)
         this.logger.debug("[mega] captcha/fa:", JSON.stringify(Object.fromEntries(cap.map((k) => [k, res[k]]))));
     }
     const userId = res.ap_cloud_user_id ?? res.user_id ?? res.userId;
+    const accountUserId = res.user_id ?? res.userId;
     const authToken = res.auth_token ?? res.token;
     if (!userId || !authToken)
       throw new Error(`login returned no session: ${JSON.stringify(res).slice(0, 200)}`);
     const faInfo = res.fa_info ?? {};
     const needs2fa = !isVerify && !!faInfo.info;
     if (needs2fa) {
-      this.auth_ = { userId, authToken, geoKey: res.geo_key };
+      this.auth_ = { userId, accountUserId, authToken, geoKey: res.geo_key };
       this.pendingCaptchaId = void 0;
       this.pending2fa = true;
       await this.sendVerifyCode(messageType);
@@ -1710,7 +1939,7 @@ var MegaHttpClient = class {
     }
     this.pendingCaptchaId = void 0;
     this.pending2fa = false;
-    this.auth_ = { userId, authToken, geoKey: res.geo_key };
+    this.auth_ = { userId, accountUserId, authToken, geoKey: res.geo_key };
     this.tokenExpiresAt = Number(res.token_expires_at ?? 0) || 0;
     this.sessionKey = void 0;
     await this.ensureSessionKey();
@@ -1723,6 +1952,7 @@ var MegaHttpClient = class {
       return;
     this.store.save({
       userId: this.auth_.userId,
+      accountUserId: this.auth_.accountUserId ?? this.auth_.userId,
       authToken: this.auth_.authToken,
       geoKey: this.auth_.geoKey,
       region: this.region,
@@ -1810,6 +2040,19 @@ function parseSecureTopic(topic) {
     return void 0;
   return { root, category, model, sn, tail: parts.slice(4).join("/") };
 }
+function solixDeviceTopics(appName, productCode, deviceSn) {
+  const dt = `dt/${appName}/${productCode}/${deviceSn}`;
+  const cmd = `cmd/${appName}/${productCode}/${deviceSn}`;
+  return {
+    paramInfo: `${dt}/param_info`,
+    stateInfo: `${dt}/state_info`,
+    cmdRes: `${cmd}/app/res`,
+    req: `${cmd}/req`
+  };
+}
+function solixUserTopics(appName, userId) {
+  return { cmdRes: `cmd/${appName}/${userId}/res`, powerSite: `dt/${appName}/${userId}/power_site` };
+}
 
 // dist/transport/mqtt/secure-mqtt.js
 var SUBACK_FAILURE = 128;
@@ -1903,7 +2146,7 @@ var SecureMqtt = class extends EventEmitter {
    * four topics for `eufy_life`).
    *
    * The grants are INSPECTED, not assumed: AWS IoT answers a policy-denied filter with a
-   * `SUBACK_FAILURE` (`0x80`) grant rather than failing the SUBSCRIBE, so subscribing with a credential
+   * SUBACK_FAILURE (`0x80`) grant rather than failing the SUBSCRIBE, so subscribing with a credential
    * whose scope doesn't cover the topic looks identical to success and then delivers nothing. A denied
    * topic is reported via `error` naming the credential scope; only an all-denied device throws, so a
    * line that grants its state channel but refuses (say) the OTA leg still works.
@@ -1912,9 +2155,8 @@ var SecureMqtt = class extends EventEmitter {
     if (!this.client)
       throw new Error("SecureMqtt not connected");
     const topics = [...subscribeTopics(device)];
-    const grants = await this.client.subscribeAsync(topics, { qos: 1 });
+    const { denied } = this.partitionGrants(await this.client.subscribeAsync(topics, { qos: 1 }));
     const scope = this.o.credentials.app_name ?? "default";
-    const denied = grants.filter((g) => g.qos === SUBACK_FAILURE).map((g) => g.topic);
     if (denied.length === topics.length) {
       throw new Error(`subscribe ${device.sn}: every topic denied on credential scope "${scope}" \u2014 this line's topics are granted to a different scope (${denied.join(", ")})`);
     }
@@ -1922,6 +2164,29 @@ var SecureMqtt = class extends EventEmitter {
       this.emit("error", new Error(`subscribe ${device.sn}: "${topic}" denied on credential scope "${scope}"`));
     }
   }
+  /**
+   * Subscribe to explicit topic filters, returning the topics that were granted. A scope-denied filter
+   * comes back with SUBACK_FAILURE rather than an error (AWS IoT quirk), so it is dropped from the result
+   * instead of throwing — callers that need every leg check the returned list. Used by lines whose topic
+   * vocabulary isn't the eufy `subscribeTopics` shape (e.g. Anker Solix `dt/{app}/{pn}/{sn}`).
+   */
+  async subscribe(topics) {
+    if (!this.client)
+      throw new Error("SecureMqtt not connected");
+    return this.partitionGrants(await this.client.subscribeAsync(topics, { qos: 1 })).granted;
+  }
+  /**
+   * Split SUBACK grants into granted vs scope-denied topics. AWS IoT marks a policy-denied filter with a
+   * SUBACK_FAILURE (`0x80`) grant rather than failing the SUBSCRIBE, so the two subscribe paths share
+   * this split and layer their own policy (drop vs report) on top.
+   */
+  partitionGrants(grants) {
+    const granted = [];
+    const denied = [];
+    for (const g of grants)
+      (g.qos === SUBACK_FAILURE ? denied : granted).push(g.topic);
+    return { granted, denied };
+  }
   /**
    * Publish a raw payload to an MQTT topic (the command leg — `cmd/{app}/{pn}/{sn}/req`). The `body`
    * is a pre-built envelope the caller supplies (the command router builds it). QoS 1 by default (the
@@ -2556,14 +2821,26 @@ var CameraDisabledError = class extends Error {
     this.name = "CameraDisabledError";
   }
 };
-var StationBusyError = class extends Error {
-  servingChannel;
-  /** Always true: the station is busy now, and stops being busy when the other stream is released. */
+var StationKeyUnavailableError = class extends Error {
+  stationSn;
+  /** Always true: the negotiation is per connection, so a later one may still produce a key. */
+  retryable = true;
+  constructor(stationSn, options) {
+    super(`station ${stationSn} did not provide its session key, so nothing that requires one could be sent`, options);
+    this.stationSn = stationSn;
+    this.name = "StationKeyUnavailableError";
+  }
+};
+var StationUnreachableError = class extends Error {
+  stationSn;
+  waitedMs;
+  /** Always true: a station unreachable now may answer on a later attempt. */
   retryable = true;
-  constructor(servingChannel, options) {
-    super(`the station is already serving channel ${servingChannel} to a viewer, and serves one camera at a time \u2014 stop that stream before opening another`, options);
-    this.servingChannel = servingChannel;
-    this.name = "StationBusyError";
+  constructor(stationSn, waitedMs, options) {
+    super(`station ${stationSn}'s P2P session did not connect within ${waitedMs}ms, so nothing could be sent to it`, options);
+    this.stationSn = stationSn;
+    this.waitedMs = waitedMs;
+    this.name = "StationUnreachableError";
   }
 };
 var LiveStreamStartError = class extends Error {
@@ -3533,7 +3810,7 @@ function sensitivityCommand(step, scale, ctx) {
     return setScalar(scale.writeId, value, ctx, "direct-binary");
   if (scale.form === "control")
     return setJson(scale.writeId, { index: value }, ctx);
-  return setPayload(scale.writeId, { sensitivity: value, channel: ctx.channel }, ctx, 0);
+  return setPayload(scale.writeId, { sensitivity: value, channel: ctx.channel }, ctx, 0, void 0, "auto");
 }
 var EXIT_TEST_MODE_VALUE = 808464384;
 function requireFamily(action, ctx, verifiedOn) {
@@ -3611,7 +3888,7 @@ var MOTION_MEMBERS = {
       const n = Number(v);
       if (!Number.isInteger(n) || n < 0)
         return void 0;
-      return setPayload(MOTION_CMD.AI_DETECT_TYPE, { ai_detect_type: n, channel: ctx.channel }, ctx, 0, 0);
+      return setPayload(MOTION_CMD.AI_DETECT_TYPE, { ai_detect_type: n, channel: ctx.channel }, ctx, 0, 0, "auto");
     }
   },
   /**
@@ -3724,7 +4001,7 @@ var MOTION_MEMBERS = {
     requires: [MOTION_CMD.HUMAN_ONLY_AT_NIGHT],
     write: (v, ctx) => {
       requireFamily("humanOnlyAtNight", ctx, "camera");
-      return setPayload(MOTION_CMD.HUMAN_ONLY_AT_NIGHT, { only_ai: asBool(v) ? 1 : 0 }, ctx, 0);
+      return setPayload(MOTION_CMD.HUMAN_ONLY_AT_NIGHT, { only_ai: asBool(v) ? 1 : 0 }, ctx, 0, void 0, "auto");
     }
   },
   /**
@@ -3741,7 +4018,7 @@ var MOTION_MEMBERS = {
     requires: [MOTION_CMD.LOITERING_DETECTION],
     write: (v, ctx) => {
       requireFamily("loiteringDetection", ctx, "camera");
-      return setPayload(MOTION_CMD.LOITERING_DETECTION, { radar_wd_switch: asBool(v) ? 1 : 0 }, ctx, 0);
+      return setPayload(MOTION_CMD.LOITERING_DETECTION, { radar_wd_switch: asBool(v) ? 1 : 0 }, ctx, 0, void 0, "auto");
     }
   }
 };
@@ -3923,12 +4200,32 @@ function decodePowerSource(raw) {
 function recordSetting(param, value, ctx) {
   return setStationScalar(param, value, ctx.channel);
 }
-var MAINS_CAMERA_MODELS = ["T8425", "T8419"];
+var MAINS_CAMERA_MODELS = ["T8425", "T8419", "T8410"];
 var notMainsCamera = (ctx) => {
   const model = (ctx.model ?? "").toUpperCase();
   return !MAINS_CAMERA_MODELS.some((prefix) => model.startsWith(prefix));
 };
-var BATTERY_MEMBERS = {
+var CELL_PARAMS = [
+  BATTERY_PARAM.BATTERY,
+  BATTERY_PARAM.BATTERY_STATUS,
+  BATTERY_PARAM.BATTERY_TEMP,
+  BATTERY_PARAM.BATTERY_HEALTH,
+  BATTERY_PARAM.SOLAR_INTENSITY,
+  BATTERY_PARAM.SOLAR_CONNECT_24H,
+  BATTERY_PARAM.BATTERY_POWER_DATAS
+];
+function cellGated(members) {
+  const gated = Object.entries(members).map(([name, m]) => {
+    const param = m.param;
+    if (typeof param !== "number" || !CELL_PARAMS.includes(param))
+      return [name, m];
+    const own = m.available;
+    const available = own ? (ctx) => notMainsCamera(ctx) && own(ctx) : notMainsCamera;
+    return [name, { ...m, available }];
+  });
+  return Object.fromEntries(gated);
+}
+var BATTERY_MEMBERS = cellGated({
   /**
    * The headline percentage, and this capability's detection evidence: reporting 1101 is what proves a
    * device is battery-powered, which is also the fact `MediaProvider` reads to decide a stream needs a
@@ -3941,7 +4238,6 @@ var BATTERY_MEMBERS = {
     unit: "%",
     kind: "percent",
     provenance: "verified",
-    available: notMainsCamera,
     description: "Battery level 0-100 (verified: param 1101)."
   },
   /**
@@ -3954,7 +4250,6 @@ var BATTERY_MEMBERS = {
     type: "bool",
     kind: "boolean",
     provenance: "apk",
-    available: notMainsCamera,
     coerce: (v) => {
       const n = Number(v);
       return n !== 0 && n !== 2;
@@ -3980,7 +4275,7 @@ var BATTERY_MEMBERS = {
     args: [{ name: "source", kind: "enum", description: "The raw value, or the name `battery`/`external`." }],
     ...accepts(),
     description: "Configured power source (1293): 0 = Battery, 1 = External Solar Panel. Verified live on T8124R. The richer raw APP_CMD_SET_POWER_SOURCE blob is surfaced separately as `powerSourceInfo` (6445). Format varies by model (plain int or JSON {power_source:N}); values beyond 0/1 shown raw.",
-    write: (v, ctx) => setPayload(BATTERY_PARAM.POWER_CHARGE, { charge_mode: v === "external" ? 1 : v === "battery" ? 0 : asBool(v) ? 1 : 0 }, ctx, 0)
+    write: (v, ctx) => setPayload(BATTERY_PARAM.POWER_CHARGE, { charge_mode: v === "external" ? 1 : v === "battery" ? 0 : asBool(v) ? 1 : 0 }, ctx, 0, void 0, "auto")
   },
   /**
    * A DEVICE-SPECIFIC mode index: the app maps value→mode through a per-model config (Hermes
@@ -4125,6 +4420,11 @@ var BATTERY_MEMBERS = {
    * Reported, so it stays in the schema and answers through `getProperty` — but given no typed getter:
    * the payload's fields have never been decoded, and a getter would hand back an opaque blob typed as
    * though it meant something.
+   *
+   * `unexposed` is NOT a substitute for the cell gate. It suppresses the fluent GETTER; `propertiesOf`
+   * filters `writeOnly` and `available` and deliberately not `unexposed`, because a schema entry
+   * reachable through `getProperty` is the whole point of the mark. So a cell param needs
+   * {@link CELL_PARAMS} either way, or a mains camera publishes "battery power history" and answers it.
    */
   batteryPowerStats: {
     param: BATTERY_PARAM.BATTERY_POWER_DATAS,
@@ -4150,7 +4450,7 @@ var BATTERY_MEMBERS = {
     unexposed: true,
     description: "Raw GET_CAMERA_INFO value (1103), meaning unevidenced \u2014 read live as the constant 5 on a T8170 at 92% and a T8171 at 27%, so it is NOT a low-battery flag."
   }
-};
+});
 var BATTERY = {
   capability: "battery",
   description: "Battery level, charging, health, temperature, and solar input.",
@@ -4293,6 +4593,10 @@ var CONTACT_MEMBERS = {
    * `1350` SET_PAYLOAD, `mChannel` = the device channel, `mValue3` 0, payload carrying the channel and a
    * transaction stamp — the byte-shape of the app's own captured frame. Out of range is refused rather
    * than clamped: the app's slider has no values outside it, so one is a caller error, not a nudge.
+   *
+   * Level-2 only, though the `mValue3` 0 would allow `"auto"`: an entry sensor's session IS its
+   * HomeBase's, which always holds a key — the second of `setPayload`'s two conditions, not an oversight
+   * of the first.
    */
   alarmVolume: {
     param: CONTACT_CMD.ALARM_VOLUME,
@@ -4520,7 +4824,7 @@ var AUDIO_MEMBERS = {
     provenance: "verified",
     available: isCameraCodec,
     description: "Record audio with video (1288 record_mute, inverted). \u2705 HW-verified on T8425: readback flips (on\u21921288=0, off\u21921288=1). The write is a 1350 SET_PAYLOAD on the device channel with `{channel, record_mute}` \u2014 the key is record_mute and it is INVERTED.",
-    write: (v, ctx) => setPayload(AUDIO_CMD.AUDIO_RECORDING, { channel: ctx.channel, record_mute: asBool(v) ? 0 : 1 }, ctx, 0)
+    write: (v, ctx) => setPayload(AUDIO_CMD.AUDIO_RECORDING, { channel: ctx.channel, record_mute: asBool(v) ? 0 : 1 }, ctx, 0, void 0, "auto")
   },
   /**
    * Doorbell ring/chime loudness — WRITE-ONLY here on purpose. The READ property `ringtoneVolume` (1708)
@@ -4968,7 +5272,7 @@ var CAMERA_MEMBERS = {
     description: "Night-vision mode (NIGHT_VISION_TYPE 1277): 0 = off, 1 = infrared (B&W), 2 = full colour. \u2705 wire verified live (T8425 ch3): 1350 SET_PAYLOAD, mChannel 0, {channel:N, night_sion:mode}. Enum labels are best-guess. Some models omit full colour.",
     write: (v, ctx) => {
       const nv = coerceEnumValue(NightVision, v);
-      return nv == null ? void 0 : setPayload(CAMERA_CMD.NIGHT_VISION_TYPE, { channel: ctx.channel, night_sion: nv }, ctx, 0, 0);
+      return nv == null ? void 0 : setPayload(CAMERA_CMD.NIGHT_VISION_TYPE, { channel: ctx.channel, night_sion: nv }, ctx, 0, 0, "auto");
     }
   },
   /**
@@ -5016,7 +5320,7 @@ var CAMERA_MEMBERS = {
     ...accepts(),
     write: (v, ctx) => {
       const q = resolveRecordingQualityTier(v);
-      return q == null ? void 0 : setPayload(CAMERA_CMD.RECORDING_QUALITY_SET, { channel: 0, mode: 0, primary_view: 0, quality: q }, ctx, 0);
+      return q == null ? void 0 : setPayload(CAMERA_CMD.RECORDING_QUALITY_SET, { channel: 0, mode: 0, primary_view: 0, quality: q }, ctx, 0, void 0, "auto");
     }
   },
   /**
@@ -5396,7 +5700,7 @@ function autoSpotlightCommand(on, ctx, opts = {}) {
     schedule: [],
     sunset2rise: 0,
     time: opts.time ?? 30
-  }, ctx, 0);
+  }, ctx, 0, void 0, "auto");
 }
 function lightSwitchWire(ctx) {
   const t = ctx.deviceType;
@@ -5935,7 +6239,7 @@ function zoomCommand(dstZoom, ctx, region) {
     offset,
     orgZoom: r.orgZoom ?? 0,
     dstZoom
-  }, ctx, 0);
+  }, ctx, 0, void 0, "auto");
 }
 function gotoPresetCommand(id, ctx) {
   return setJson(PTZ_CMD.PTZ_PRESET_GOTO, { settingstate: 0, value: id }, ctx);
@@ -6331,7 +6635,7 @@ var DOORBELL_MEMBERS = {
     min: 0,
     max: 100,
     description: "Doorbell chime volume, 0-100 (1717 APP_CMD_BAT_DOORBELL_SET_DINGDONG_VOLUME; SET_PAYLOAD envelope, distinct from the direct-binary ringtoneVolume/1708 \u2014 see DOORBELL_CMD.DINGDONG_VOLUME). Write wire-confirmed live on T8214, observed values 3 and 25.",
-    write: (v, ctx) => setPayload(DOORBELL_CMD.DINGDONG_VOLUME, { dingdong_volume: Number(v) }, ctx, 0)
+    write: (v, ctx) => setPayload(DOORBELL_CMD.DINGDONG_VOLUME, { dingdong_volume: Number(v) }, ctx, 0, void 0, "auto")
   },
   /**
    * The same `1350` SET_PAYLOAD shape and capture session as {@link DOORBELL_MEMBERS.dingdongVolume},
@@ -6349,7 +6653,7 @@ var DOORBELL_MEMBERS = {
     description: "Doorbell chime ringtone SELECTION INDEX, not a bool (1718 APP_CMD_BAT_DOORBELL_SET_DINGDONG_RINGTONE; SET_PAYLOAD envelope \u2014 see DOORBELL_CMD.DINGDONG_RINGTONE). Write wire-confirmed live on T8214, observed values 4 and 0. Named options: see the {@link DoorbellRingtone} enum. A write outside that enum is REJECTED, not clamped into range \u2014 this is a selection, not a volume, so a bad index would otherwise land on a real-but-wrong tone.",
     write: (v, ctx) => {
       const tone = coerceEnumValue(DoorbellRingtone, v);
-      return tone === void 0 ? void 0 : setPayload(DOORBELL_CMD.DINGDONG_RINGTONE, { dingdong_ringtone: tone }, ctx, 0);
+      return tone === void 0 ? void 0 : setPayload(DOORBELL_CMD.DINGDONG_RINGTONE, { dingdong_ringtone: tone }, ctx, 0, void 0, "auto");
     }
   },
   /**
@@ -6894,8 +7198,18 @@ var ArmingMode = {
   away: "away",
   /** Armed for occupancy — reduced/perimeter protection while home (wire value 1). */
   home: "home",
+  /** Scheduled — the station follows the timetable configured in the app (wire value 2). */
+  schedule: "schedule",
   /** Custom 1 — a user-defined posture configured in the app (wire value 3). */
   custom1: "custom1",
+  /** Custom 2 — a user-defined posture configured in the app (wire value 4). */
+  custom2: "custom2",
+  /** Custom 3 — a user-defined posture configured in the app (wire value 5). */
+  custom3: "custom3",
+  /** Off — the station's alarm system is switched off entirely (wire value 6). */
+  off: "off",
+  /** Geofenced — the station follows the app's location-based rules (wire value 47). */
+  geo: "geo",
   /** Disarmed — no alarms; sensors still report state (wire value 63). */
   disarmed: "disarmed"
 };
@@ -6916,10 +7230,14 @@ var ARMING_CMD = {
    *
    * ⚠️ Only 3 of the 9 modes were exercised in that capture — `mode_type` 0 (away), 63 (disarmed), 1
    * (home), all confirmed byte-exact. Re-confirmed live 2026-08-05: each reported its own MODE_SWITCH push
-   * within ~5s of the write. `custom1` 3 joined {@link ArmingMode} on a live confirmation rather than a
-   * capture, making four settable in total. The remaining five are named by the app but never observed
-   * leaving it, so this capability reads them and refuses to send them. See `ARMING_MODE_WIRE` for the
-   * per-value breakdown.
+   * within ~5s of the write. The remaining six are live confirmations rather than captures — `custom1` 3
+   * first, then `schedule` 2, `custom2` 4, `custom3` 5, `off` 6 and `geo` 47 — each sent as this exact
+   * frame and each observed to bring MODE_SWITCH back, so all nine are settable. `ARMING_MODE_WIRE` has
+   * the per-value evidence and the dates.
+   *
+   * The ENCRYPTION LEVEL is the session's to pick (`"auto"`), not this command's: the T8030 the envelope
+   * was captured on holds a level-2 key and seals it level-2, while an own-session camera that never
+   * negotiates one carries the same envelope level-1. See `armingCommand`.
    */
   SET_ARMING: 1224,
   /**
@@ -6953,20 +7271,14 @@ var ARMING_MODE_WIRE = {
   away: 0,
   home: 1,
   schedule: 2,
-  // ⚠️ reportable, NOT settable — see the doc comment above
   custom1: 3,
   custom2: 4,
-  // ⚠️ reportable, NOT settable — see the doc comment above
   custom3: 5,
-  // ⚠️ reportable, NOT settable — see the doc comment above
   off: 6,
-  // ⚠️ reportable, NOT settable — see the doc comment above
   geo: 47,
-  // ⚠️ reportable, NOT settable — see the doc comment above
   disarmed: 63
 };
 var ARMING_MODE_LABELS = enumLabels(ARMING_MODE_WIRE);
-var SETTABLE_MODES = Object.values(ArmingMode).map((m) => ARMING_MODE_WIRE[m]);
 function armingModeOf(v) {
   const name = String(v);
   if (name in ArmingMode)
@@ -6975,11 +7287,10 @@ function armingModeOf(v) {
   return Object.values(ArmingMode).find((m) => ARMING_MODE_WIRE[m] === wire);
 }
 function armingCommand(mode, ctx) {
-  const modeType = ARMING_MODE_WIRE[mode];
   if (!ctx.accountName) {
     throw new Error(`arming: missing account identity (user_name) [${describeDevice(ctx)}]`);
   }
-  return setPayload(ARMING_CMD.SET_ARMING, { mode_type: modeType, user_name: ctx.accountName }, ctx, 0);
+  return setPayload(ARMING_CMD.SET_ARMING, { mode_type: ARMING_MODE_WIRE[mode], user_name: ctx.accountName }, ctx, 0, void 0, "auto");
 }
 function alarmDelayCommand(mode, config, ctx) {
   const data = {
@@ -6996,11 +7307,10 @@ function alarmDelayCommand(mode, config, ctx) {
 }
 var ARMING_MEMBERS = {
   /**
-   * The one member whose write domain is NARROWER than its read: `enumValues` names all nine modes a
-   * station can report, and the argument's `values` publishes only the four whose write is confirmed. That
-   * argument IS the domain the derived setter enforces and the refusal names, so an unconfirmed mode is
-   * refused by naming the four that work — nine labels for the read and four for the write, off one
-   * declaration.
+   * Read and write are the same nine modes, so `enumValues` is the whole domain: `writeDomain` falls back
+   * to it, and the derived setter, the refusal message and the offered argument all read from that one
+   * declaration. A member states an `args` entry only where the two sides DIFFER. See
+   * {@link ARMING_MODE_WIRE} for the per-value evidence.
    *
    * `armingCommand` may also throw synchronously (missing account identity) and `bindMembers` turns that
    * into a rejection, so the builder stays plain.
@@ -7019,8 +7329,7 @@ var ARMING_MEMBERS = {
     kind: "enum",
     enumValues: ARMING_MODE_LABELS,
     provenance: "verified",
-    args: [{ name: "mode", kind: "enum", values: SETTABLE_MODES }],
-    description: "Guard mode (verified: param 1224 = GUARD_MODE, read/write mechanism confirmed). Reads all 9 modes the app defines; SETS only the 4 whose write is confirmed (away/home/custom1/disarmed) \u2014 schedule/custom2/custom3/off/geo are named by the app but no capture shows one being sent, so they are refused rather than guessed; see ARMING_MODE_WIRE in arming.ts for the breakdown.",
+    description: "Guard mode (verified: param 1224 = GUARD_MODE, read/write mechanism confirmed). Reads and SETS all 9 modes the app defines \u2014 away/home/schedule/custom1/custom2/custom3/off/geo/disarmed. Three are byte-captured writes and six are live-confirmed (each sent and observed to report its own MODE_SWITCH); see ARMING_MODE_WIRE in arming.ts for the per-value evidence.",
     observation: {
       event: "armingModeChanged",
       reflects: (value) => ({ param: ARMING_CMD.SET_ARMING, expected: ARMING_MODE_WIRE[armingModeOf(value)] }),
@@ -7715,6 +8024,89 @@ var ModeCtrlMethod = {
   STOP_SMART_FOLLOW: 18,
   START_GLOBAL_CRUISE: 20
 };
+var ModeCtrlParamMethod = {
+  /** `START_SELECT_ROOMS_CLEAN` — clean the named rooms of a named map. */
+  SELECT_ROOMS: { method: 1, param: 4 },
+  /** `START_SELECT_ZONES_CLEAN` — clean the given rectangles of a named map. */
+  SELECT_ZONES: { method: 2, param: 5 },
+  /** `START_GOTO_CLEAN` — drive to a point and clean around it. */
+  GOTO: { method: 4, param: 7 },
+  /** `START_SCENE_CLEAN` — run a saved scene by its id. */
+  SCENE: { method: 24, param: 14 }
+};
+var SELECT_ROOMS_FIELD = {
+  /** `rooms` — repeated, one entry per room. */
+  ROOMS: 1,
+  /** `clean_times` — how many passes to make. */
+  CLEAN_TIMES: 2,
+  /** `map_id` — WHICH saved map the room ids belong to. */
+  MAP_ID: 3,
+  /** `id` within a `Room`. */
+  ROOM_ID: 1,
+  /** `order` within a `Room` — the sequence to visit them in. */
+  ROOM_ORDER: 2
+};
+var SELECT_ZONES_FIELD = {
+  /** `zones` — repeated, one entry per rectangle. */
+  ZONES: 1,
+  /** `map_id` — which saved map the coordinates belong to. */
+  MAP_ID: 2,
+  /** `quadrangle` within a `Zone` — its four corners. */
+  QUADRANGLE: 1,
+  /** `clean_times` within a `Zone`. */
+  ZONE_CLEAN_TIMES: 2,
+  /** `x` within a `Point`, SIGNED centimetres. */
+  POINT_X: 1,
+  /** `y` within a `Point`, SIGNED centimetres. */
+  POINT_Y: 2
+};
+var SCENE_CLEAN_ID = 1;
+function encodeModeCtrlParam(method2, paramField, build) {
+  return rawDp((w) => {
+    if (method2 !== 0)
+      w.int(MODE_CTRL_FIELD.METHOD, method2);
+    w.int(MODE_CTRL_FIELD.SEQ, nextModeCtrlSeq());
+    w.sub(paramField, build);
+  });
+}
+function encodeSelectRoomsClean(mapId, rooms, cleanTimes = 1) {
+  const { method: method2, param } = ModeCtrlParamMethod.SELECT_ROOMS;
+  return encodeModeCtrlParam(method2, param, (p) => {
+    for (const room of rooms) {
+      p.sub(SELECT_ROOMS_FIELD.ROOMS, (r) => {
+        r.int(SELECT_ROOMS_FIELD.ROOM_ID, room.id);
+        if (room.order !== void 0)
+          r.int(SELECT_ROOMS_FIELD.ROOM_ORDER, room.order);
+      });
+    }
+    p.int(SELECT_ROOMS_FIELD.CLEAN_TIMES, cleanTimes);
+    p.int(SELECT_ROOMS_FIELD.MAP_ID, mapId);
+  });
+}
+function encodeSelectZonesClean(mapId, zones) {
+  const { method: method2, param } = ModeCtrlParamMethod.SELECT_ZONES;
+  return encodeModeCtrlParam(method2, param, (p) => {
+    for (const zone of zones) {
+      p.sub(SELECT_ZONES_FIELD.ZONES, (z) => {
+        z.sub(SELECT_ZONES_FIELD.QUADRANGLE, (q) => {
+          for (const [i, corner] of zone.corners.entries()) {
+            q.sub(i + 1, (pt) => {
+              pt.sint(SELECT_ZONES_FIELD.POINT_X, corner.x);
+              pt.sint(SELECT_ZONES_FIELD.POINT_Y, corner.y);
+            });
+          }
+        });
+        if (zone.cleanTimes !== void 0)
+          z.int(SELECT_ZONES_FIELD.ZONE_CLEAN_TIMES, zone.cleanTimes);
+      });
+    }
+    p.int(SELECT_ZONES_FIELD.MAP_ID, mapId);
+  });
+}
+function encodeSceneClean(sceneId) {
+  const { method: method2, param } = ModeCtrlParamMethod.SCENE;
+  return encodeModeCtrlParam(method2, param, (p) => p.int(SCENE_CLEAN_ID, sceneId));
+}
 var modeCtrlSeq = 111;
 function nextModeCtrlSeq() {
   return ++modeCtrlSeq;
@@ -9550,7 +9942,41 @@ var VACUUM_CLEAN_MEMBERS = {
   /** Return to the dock via ModeCtrlRequest method 6 (DP 152). AIoT only — Tuya write unverified. */
   returnToDock: method(({ sink }) => () => sink.dispatch(aiotDp(VACUUM_DP.MODE_CTRL, encodeModeCtrl(ModeCtrlMethod.START_GOHOME, nextModeCtrlSeq()))), "Return to the dock (ModeCtrlRequest method 6 over DP 152).", isAiotVacuum),
   /** Pause the current cleaning task via ModeCtrlRequest method 13 (DP 152). AIoT only — Tuya write unverified. */
-  pauseCleaning: method(({ sink }) => () => sink.dispatch(aiotDp(VACUUM_DP.MODE_CTRL, encodeModeCtrl(ModeCtrlMethod.PAUSE_TASK, nextModeCtrlSeq()))), "Pause the current cleaning task (ModeCtrlRequest method 13 over DP 152).", isAiotVacuum)
+  pauseCleaning: method(({ sink }) => () => sink.dispatch(aiotDp(VACUUM_DP.MODE_CTRL, encodeModeCtrl(ModeCtrlMethod.PAUSE_TASK, nextModeCtrlSeq()))), "Pause the current cleaning task (ModeCtrlRequest method 13 over DP 152).", isAiotVacuum),
+  /**
+   * Run a saved cleaning scene by its id (ModeCtrlRequest method 24 over DP 152).
+   *
+   * The id is the device's own, as {@link VACUUM_CLEAN_MEMBERS.scenes} reports it — `VacuumScene.id`
+   * off the `SceneResponse` on DP 180. A scene the device reports invalid stays reportable and running
+   * it is still a well-formed request; `VacuumScene.invalidReason` says why the device will refuse.
+   *
+   * Frame shape is byte-proven against the shared outer `ModeCtrlRequest`, and method 24 has been
+   * WATCHED: run on a T2351, it started the named scene.
+   */
+  startScene: method(({ sink }) => (sceneId) => sink.dispatch(aiotDp(VACUUM_DP.MODE_CTRL, encodeSceneClean(sceneId))), "Run a saved cleaning scene by its id (ModeCtrlRequest method 24 over DP 152).", isAiotVacuum),
+  /**
+   * Clean the named rooms of a named map (ModeCtrlRequest method 1 over DP 152).
+   *
+   * `mapId` has no default and that is deliberate: room ids are per map, so assuming the map a
+   * single-floor home would have sends a two-floor home's ids against the wrong floor. `SceneInfo.mapid`
+   * on DP 180 and a scheduled rooms-clean's `map_id` are the two real map ids the device reports.
+   *
+   * `cleanTimes` is how many passes to make over the set; rooms with no `order` are visited in the
+   * order given.
+   *
+   * Frame shape is byte-proven against the shared outer `ModeCtrlRequest`, and method 1 has been
+   * WATCHED: run on a T2351, it cleaned the rooms named.
+   */
+  cleanRooms: method(({ sink }) => (mapId, rooms, cleanTimes = 1) => sink.dispatch(aiotDp(VACUUM_DP.MODE_CTRL, encodeSelectRoomsClean(mapId, rooms, cleanTimes))), "Clean the named rooms of a named map (ModeCtrlRequest method 1 over DP 152).", isAiotVacuum),
+  /**
+   * Clean the given rectangles of a named map (ModeCtrlRequest method 2 over DP 152).
+   *
+   * Corners are SIGNED centimetres in the map's own frame, whose origin sits wherever the robot first
+   * mapped from — negative coordinates are ordinary and are ZigZag-encoded, not written as plain
+   * varints. Same `mapId` reasoning as {@link VACUUM_CLEAN_MEMBERS.cleanRooms}, and the same evidence:
+   * method 2 was run on a T2351 and cleaned the rectangles given.
+   */
+  cleanZones: method(({ sink }) => (mapId, zones) => sink.dispatch(aiotDp(VACUUM_DP.MODE_CTRL, encodeSelectZonesClean(mapId, zones))), "Clean the given rectangles of a named map (ModeCtrlRequest method 2 over DP 152).", isAiotVacuum)
 };
 var VACUUM_CLEAN = {
   capability: "vacuum_clean",
@@ -9726,6 +10152,70 @@ function toNumberArray(arr) {
   return result;
 }
 
+// dist/model/capabilities/display.js
+var DISPLAY_PARAM = { BATTERY: 8001, SOFTWARE_VERSION: 8003 };
+var DISPLAY_MEMBERS = {
+  /**
+   * Battery level, 0-100.
+   *
+   * **On this capability rather than on `battery`, and that is the line partition doing its job.** The
+   * security-line `battery` capability reads param 1101 and a Smart Display's charge is 8001 in its own
+   * id space — two wires that happen to mean the same thing. One capability reading both would be a claim
+   * that the two ecosystems share a param space, so a consumer reads a display's charge through
+   * `dev.display()` and a camera's through `dev.battery()`.
+   *
+   * `verified` rather than `mega`: the id is in the device's cloud record, but the NAME came from the
+   * maintainer's own knowledge of the hardware rather than from the cloud data-point list, and `"100"`
+   * fits brightness, volume or charge equally.
+   *
+   * The scale is `percent` on the reading itself, not on convention alone: a full charge reads `255` on a
+   * 0-255 scale and `1000` on a 0-1000 one, so `"100"` on a charged unit is positive evidence for 0-100
+   * rather than merely consistent with it. What nobody has done is watch it MOVE, which is why a value
+   * frozen at 100 would not yet be distinguishable from a healthy one.
+   */
+  battery: {
+    param: DISPLAY_PARAM.BATTERY,
+    type: "number",
+    unit: "%",
+    kind: "percent",
+    provenance: "verified",
+    description: "Battery level, 0-100 (param 8001)."
+  },
+  /**
+   * Version-shaped, and that shape is the whole of the evidence — hence `guessed`, and hence no typed
+   * getter: a caller reading this off a bound object cannot see the label.
+   *
+   * `unexposed` rather than absent, so the schema still carries its type and that label and
+   * `getProperty("softwareVersion")` still answers. `dev.info()?.firmwareVersion` is the field to trust
+   * where the cloud record carries one; on this display it does not, which is the only reason 8003 is
+   * named at all.
+   */
+  softwareVersion: {
+    param: DISPLAY_PARAM.SOFTWARE_VERSION,
+    type: "string",
+    kind: "text",
+    provenance: "guessed",
+    unexposed: true,
+    description: "Version-shaped string (param 8003), meaning unconfirmed \u2014 prefer `info.firmwareVersion`."
+  }
+};
+var DISPLAY = {
+  capability: "display",
+  line: "display",
+  description: "Smart Display battery level (param 8001, display namespace).",
+  members: DISPLAY_MEMBERS,
+  properties: propertiesOf(DISPLAY_MEMBERS),
+  /**
+   * Claimed by CODEC, not by an evidence param.
+   *
+   * 8001 is in the device's cloud record, so the ordinary evidence gate would install the getter anyway
+   * — but the capability should attach to a Smart Display that has reported nothing yet too, because a
+   * device on this line has no other capability to carry it. The line partition keeps this off
+   * everything else: `display` is the only codec in the `display` line.
+   */
+  detection: { codecs: ["display"] }
+};
+
 // dist/model/capabilities/locate.js
 var LOCATE_DP = 160;
 var LEGACY_LOCATE_DP = TUYA_VACUUM_DP.LOOK_FOR_SWEEPER;
@@ -9854,6 +10344,7 @@ var MODULES = [
   VACUUM_DOCK,
   SUCTION,
   LOCATE,
+  DISPLAY,
   INFO
 ];
 var BY_CAP = new Map(MODULES.map((m) => [m.capability, m]));
@@ -9861,6 +10352,16 @@ function getCapabilityModule(cap) {
   return BY_CAP.get(cap);
 }
 var CAPABILITY_MODULES = Object.fromEntries(MODULES.map((m) => [m.capability, m]));
+function claimedParams(caps) {
+  const claimed = /* @__PURE__ */ new Set();
+  for (const cap of caps)
+    for (const spec of getCapabilityModule(cap)?.properties ?? []) {
+      claimed.add(spec.paramType);
+      for (const alias of spec.readAliases ?? [])
+        claimed.add(alias.paramType);
+    }
+  return claimed;
+}
 function mergeProperties(caps, ctx) {
   const seen = /* @__PURE__ */ new Set();
   const merged = [];
@@ -9898,11 +10399,11 @@ var CODEC_LINE = {
   mower: "clean",
   light: "life",
   printer: "print",
-  display: "security"
+  display: "display"
 };
 function lineAllows(module, codec) {
   const line = module.line ?? "security";
-  return line === "any" || line === CODEC_LINE[codec];
+  return line === "any" || codec !== void 0 && line === CODEC_LINE[codec];
 }
 function detectCapabilities(rec, codec) {
   const found = /* @__PURE__ */ new Set();
@@ -9932,10 +10433,10 @@ function detectCapabilities(rec, codec) {
     if (!matched && d.modelHints && haystack.length > 0) {
       matched = d.modelHints.some((re) => re.test(haystack));
     }
-    if (!matched && d.codecs) {
+    if (!matched && d.codecs && codec !== void 0) {
       matched = d.codecs.includes(codec);
     }
-    if (!matched && d.detect) {
+    if (!matched && d.detect && codec !== void 0) {
       try {
         matched = d.detect(rec, codec) === true;
       } catch {
@@ -10143,6 +10644,11 @@ var MODEL_REGISTRY = {
   T8210: { codec: "camera", caps: ["doorbell", "battery"], name: "Video Doorbell" },
   // Confirmed against a real owned unit (named "Doorbell"): Video Doorbell Dual.
   T8214: { codec: "camera", caps: ["doorbell", "battery"], name: "Video Doorbell Dual" },
+  // Confirmed against a real owned unit: the mains-powered Wired Doorbell 2K. No `battery` row
+  // member on purpose — this model is wired, so the codec baseline plus inference is the whole
+  // truth for power. Without this row it classified as a plain camera, so the doorbell capability
+  // never appeared and consumers got no doorbell event entity or ring trigger.
+  T8200: { codec: "camera", caps: ["doorbell"], name: "Wired Doorbell 2K" },
   // Cameras observed on real owned hardware (inspect-device sweep). Names from the app's own
   // model-family constants (scripts/data/app_model_registry.json); caps mirror what the device
   // reports. T8171 has no family entry in that dump, so it keeps the raw T-code.
@@ -11998,6 +12504,28 @@ var CLEAN_PARAMS = {
     provenance: "mega"
   }
 };
+var DISPLAY_PARAMS = {
+  8001: {
+    name: "battery",
+    type: "number",
+    provenance: "verified"
+  },
+  8003: {
+    name: "softwareVersion",
+    type: "string",
+    provenance: "guessed"
+  },
+  8005: {
+    name: "modelName",
+    type: "string",
+    provenance: "mega"
+  },
+  8006: {
+    name: "modelCode",
+    type: "string",
+    provenance: "mega"
+  }
+};
 
 // dist/model/life-params.js
 var LIFE_PARAMS = {
@@ -12025,7 +12553,10 @@ var TABLES = {
   // 3D-printer (ankermake) id space — empty until a live capture confirms the param↔semantic map
   // (printer-support plan Stage 3). Present so the printer codec resolves to its OWN namespace rather
   // than falling through to `security` and decoding another line's dictionary.
-  print: {}
+  print: {},
+  // Smart Display (T87Ax) — ids 8001-8006, four of them named. Same reason as `print`: its own
+  // dictionary rather than a corner of another line's.
+  display: DISPLAY_PARAMS
 };
 function paramDef(ns, paramType) {
   return TABLES[ns][paramType];
@@ -12040,7 +12571,7 @@ var NAMESPACE_BY_CODEC = {
   mower: "clean",
   light: "life",
   printer: "print",
-  display: "security"
+  display: "display"
 };
 function namespaceForCodec(codec) {
   return NAMESPACE_BY_CODEC[codec];
@@ -12127,6 +12658,11 @@ var Device = class _Device {
    * different wire ids across device families still resolves to one named value.
    */
   specByParam;
+  /**
+   * Params a resolved capability declares that this device's schema does not carry — withheld by a
+   * member's gate, so not named from the param dictionary either. See {@link Device.applyParams}.
+   */
+  withheld = /* @__PURE__ */ new Set();
   /** Which param namespace this device's ids live in (clean DPs vs security P2P). */
   namespace;
   /** The record's `device_name` as stated, before the {@link modelName} fallback is applied. */
@@ -12193,6 +12729,7 @@ var Device = class _Device {
           byParam.set(a.paramType, { spec: p, invert: a.invert ?? false });
     }
     this.specByParam = byParam;
+    this.withheld = new Set([...claimedParams(resolved.capabilities)].filter((pt) => !byParam.has(pt)));
     this.namespace = namespaceForCodec(resolved.codec);
     this.installAccessors();
   }
@@ -12355,6 +12892,16 @@ var Device = class _Device {
    * Apply a raw param map (cloud record or P2P notification). Known params update their named
    * property; unrecognised params are retained as `unknown_<paramType>` so nothing is lost.
    *
+   * Naming precedence: this device's own `PropertySpec` (curated), then the param dictionary for its
+   * namespace, then the `unknown_<paramType>` passthrough. The dictionary def is consulted even where a
+   * spec exists, because `encoding` lives there.
+   *
+   * A param a resolved capability's gate WITHHELD takes the passthrough instead of its dictionary name.
+   * The gate decided the read does not describe this device, the dictionary names it what the member
+   * would have, and republishing it there hands a caller a reading indistinguishable from one the device
+   * really answered. A capability that never resolved withholds nothing: a param arriving before its
+   * capability is still the device's own, and keeps its dictionary name.
+   *
    * @param params param_type → raw value.
    * @param ts observation time (epoch ms); defaults to `Date.now()`.
    * @returns the list of property names whose value changed.
@@ -12367,7 +12914,7 @@ var Device = class _Device {
         continue;
       const hit = this.specByParam.get(pt);
       const spec = hit?.spec;
-      const def = paramDef(this.namespace, pt);
+      const def = this.withheld.has(pt) ? void 0 : paramDef(this.namespace, pt);
       const name = spec ? spec.name : def ? def.name : `${UNKNOWN_PARAM_PREFIX}${pt}`;
       const value = def?.encoding ? decodeEncoded(rawVal, def.encoding) : spec ? coerce(spec, rawVal, hit.invert, this.logger) : def ? coerceByType(def.type, rawVal, def.name, this.logger) : String(rawVal);
       const prev = this.state.get(name);
@@ -12569,7 +13116,7 @@ function lz4BlockDecompress(block, size) {
   const end = block.length;
   let pos = 0;
   let written = 0;
-  const extend = (base) => {
+  const extend2 = (base) => {
     let len = base;
     if (base !== 15)
       return len;
@@ -12584,7 +13131,7 @@ function lz4BlockDecompress(block, size) {
   };
   while (pos < end) {
     const token = block[pos++];
-    const literals = extend(token >> 4);
+    const literals = extend2(token >> 4);
     if (literals === void 0)
       return void 0;
     if (pos + literals > end || written + literals > size)
@@ -12599,7 +13146,7 @@ function lz4BlockDecompress(block, size) {
     pos += 2;
     if (offset === 0 || offset > written)
       return void 0;
-    const match = extend(token & 15);
+    const match = extend2(token & 15);
     if (match === void 0)
       return void 0;
     const length = match + 4;
@@ -13103,24 +13650,394 @@ function inspectParams(rec, sn) {
   };
 }
 
-// dist/client/map-channels.js
-var reader = (kind, decode) => (raw, codec) => {
-  const value = decode(raw, codec);
-  return value === void 0 ? void 0 : { kind, value };
+// dist/model/capabilities/solix.js
+var SOLIX_ENERGY_METER_MEMBERS = {
+  /** Line-1 voltage (V), ff09 tag `0xAC` — confirmed live (a nominal mains voltage). */
+  meterVoltageL1: {
+    param: 172,
+    type: "number",
+    kind: "scalar",
+    unit: "V",
+    provenance: "verified",
+    description: "Meter line-1 voltage (V) \u2014 ff09 tag 0xAC, confirmed against a live single-phase frame."
+  },
+  /** Line-2 voltage (V), ff09 tag `0xAD` — the app's field; reads 0 until a multi-phase frame carries it. */
+  meterVoltageL2: {
+    param: 173,
+    type: "number",
+    kind: "scalar",
+    unit: "V",
+    provenance: "guessed",
+    description: "Meter line-2 voltage (V) \u2014 ff09 tag 0xAD; phase assignment inferred from block ordering (never observed non-zero), 0 on a single-phase install."
+  },
+  /** Line-3 voltage (V), ff09 tag `0xAE` — the app's field; reads 0 until a multi-phase frame carries it. */
+  meterVoltageL3: {
+    param: 174,
+    type: "number",
+    kind: "scalar",
+    unit: "V",
+    provenance: "guessed",
+    description: "Meter line-3 voltage (V) \u2014 ff09 tag 0xAE; phase assignment inferred from block ordering (never observed non-zero), 0 on a single-phase install."
+  },
+  /** Line-1 current (A), ff09 tag `0xAF` — confirmed live (the line's CT current). */
+  meterCurrentL1: {
+    param: 175,
+    type: "number",
+    kind: "scalar",
+    unit: "A",
+    provenance: "verified",
+    description: "Meter line-1 current (A) \u2014 ff09 tag 0xAF, confirmed against a live single-phase frame."
+  },
+  /** Line-2 current (A), ff09 tag `0xB0` — the app's field; reads 0 until a multi-phase frame carries it. */
+  meterCurrentL2: {
+    param: 176,
+    type: "number",
+    kind: "scalar",
+    unit: "A",
+    provenance: "guessed",
+    description: "Meter line-2 current (A) \u2014 ff09 tag 0xB0; phase assignment inferred from block ordering (never observed non-zero), 0 on a single-phase install."
+  },
+  /** Line-3 current (A), ff09 tag `0xB1` — the app's field; reads 0 until a multi-phase frame carries it. */
+  meterCurrentL3: {
+    param: 177,
+    type: "number",
+    kind: "scalar",
+    unit: "A",
+    provenance: "guessed",
+    description: "Meter line-3 current (A) \u2014 ff09 tag 0xB1; phase assignment inferred from block ordering (never observed non-zero), 0 on a single-phase install."
+  },
+  /** Line-1 active power (W), ff09 tag `0xA8` — confirmed live; negative on export. */
+  meterPowerL1: {
+    param: 168,
+    type: "number",
+    kind: "scalar",
+    unit: "W",
+    provenance: "verified",
+    description: "Meter line-1 active power (W) \u2014 ff09 tag 0xA8, confirmed live; negative on export."
+  },
+  /** Line-2 active power (W), ff09 tag `0xA9` — the app's field; reads 0 until a multi-phase frame carries it. */
+  meterPowerL2: {
+    param: 169,
+    type: "number",
+    kind: "scalar",
+    unit: "W",
+    provenance: "guessed",
+    description: "Meter line-2 active power (W) \u2014 ff09 tag 0xA9; phase assignment inferred from block ordering (never observed non-zero), 0 on a single-phase install."
+  },
+  /** Line-3 active power (W), ff09 tag `0xAA` — the app's field; reads 0 until a multi-phase frame carries it. */
+  meterPowerL3: {
+    param: 170,
+    type: "number",
+    kind: "scalar",
+    unit: "W",
+    provenance: "guessed",
+    description: "Meter line-3 active power (W) \u2014 ff09 tag 0xAA; phase assignment inferred from block ordering (never observed non-zero), 0 on a single-phase install."
+  },
+  /** Aggregate active power (W), ff09 tag `0xAB` — confirmed live; equals line-1 on a single phase. */
+  meterPowerTotal: {
+    param: 171,
+    type: "number",
+    kind: "scalar",
+    unit: "W",
+    provenance: "verified",
+    description: "Meter total active power (W) \u2014 ff09 tag 0xAB, confirmed live; equals L1 on one phase."
+  }
 };
-var READER_BY_CHANNEL = {
-  MAP_DATA: reader("plane", decodeVacuumMap),
-  ROOM_OUTLINE: reader("outline", decodeVacuumRoomOutline),
-  ROOM_PARAMS: reader("rooms", decodeVacuumRoomParams),
-  RESTRICTED_ZONE: reader("zones", decodeVacuumRestrictedZones),
-  DYNAMIC_DATA: reader("pose", decodeVacuumPose)
+var CATEGORY_CAPABILITIES = {
+  "Portable Power Station": ["battery", "acOutput", "solarInput"],
+  /**
+   * NOT `energyMeter`: a home battery measures its own grid/PV/output power, but that is a different
+   * ff09 tag family than the AE1X0 Smart Meter's — the `energyMeter` members are AE1X0-specific, so a
+   * Solarbank frame decoded through them mislabels (tag `0xac` is power on a Solarbank, voltage on the
+   * meter — enforced by the meter-family gate in {@link SOLIX_METER_MODELS} / the transport decoder,
+   * see PR #186). `energyMeter` is model-detected for the meter, not category-detected.
+   */
+  "Plug-in Home Battery": ["battery", "solarInput", "acOutput"],
+  "Powered Cooler": ["battery", "cooler"],
+  "Power Bank": ["battery"],
+  "Smart EV Charger": ["evCharger"],
+  Charger: ["charger"],
+  Accessory: []
 };
-var DECODED_MAP_CHANNELS = Object.keys(READER_BY_CHANNEL);
-var READERS = new Map(DECODED_MAP_CHANNELS.map((name) => [BIZ_CHANNEL[name], READER_BY_CHANNEL[name]]));
-function decodeMapFrame(frame, codec) {
-  if (frame.offset !== 0)
-    return void 0;
-  return READERS.get(frame.channelId)?.(frame.payload, codec);
+var SOLIX_METER_MODELS = ["AE1X0"];
+var SOLARBANK_MODELS = ["A1790", "A17C", "AE10"];
+function detectSolixCapabilities(rec, category) {
+  const caps = /* @__PURE__ */ new Set(["identity"]);
+  if (rec.device_sw_version)
+    caps.add("firmware");
+  if (rec.wifi_online !== void 0 || rec.rssi != null || rec.wifi_name)
+    caps.add("connectivity");
+  for (const c of category && CATEGORY_CAPABILITIES[category] || [])
+    caps.add(c);
+  if (SOLIX_METER_MODELS.some((m) => rec.product_code?.startsWith(m)))
+    caps.add("energyMeter");
+  if (SOLARBANK_MODELS.some((m) => rec.product_code?.startsWith(m))) {
+    caps.add("battery");
+    caps.add("solarInput");
+  }
+  return caps;
+}
+
+// dist/model/solix-catalog.js
+function buildModelIndex(categories) {
+  const index = /* @__PURE__ */ new Map();
+  for (const category of categories) {
+    for (const product of category.products ?? []) {
+      const entry = { name: product.name, category: category.name.trim() };
+      if (product.product_code)
+        index.set(product.product_code, entry);
+      for (const variant of product.p_codes ?? []) {
+        const code = typeof variant === "string" ? variant : variant?.product_code;
+        if (code)
+          index.set(code, entry);
+      }
+    }
+  }
+  return index;
+}
+
+// dist/model/solix-family.js
+var CATEGORY_FAMILY = {
+  "Portable Power Station": "powerStation",
+  "Power Bank": "powerBank",
+  "Powered Cooler": "cooler",
+  "Smart EV Charger": "evCharger",
+  Charger: "charger"
+};
+var hasPrefix = (code, prefixes) => !!code && prefixes.some((p) => code.startsWith(p));
+var isSolixSolarbank = (input) => hasPrefix(input.product_code, SOLARBANK_MODELS) || input.category === "Plug-in Home Battery";
+var isSolixSmartMeter = (input) => hasPrefix(input.product_code, SOLIX_METER_MODELS);
+var isSolixPowerStation = (input) => input.category === "Portable Power Station";
+function solixProductFamily(input) {
+  if (isSolixSmartMeter(input))
+    return "smartMeter";
+  if (isSolixSolarbank(input))
+    return "solarbank";
+  return (input.category ? CATEGORY_FAMILY[input.category] : void 0) ?? "unknown";
+}
+
+// dist/model/solix-device.js
+var READ_ONLY_SINK = { dispatch: async () => {
+} };
+var SolixDevice = class {
+  serial;
+  productCode;
+  record;
+  caps;
+  identity_;
+  values = {};
+  constructor(record, opts = {}) {
+    this.record = record;
+    this.serial = record.device_sn;
+    this.productCode = record.product_code;
+    const label = opts.catalog ? buildModelIndex(opts.catalog).get(record.product_code) : void 0;
+    this.identity_ = {
+      serial: record.device_sn,
+      productCode: record.product_code,
+      name: label?.name ?? record.alias_name ?? record.device_name ?? record.product_code,
+      category: label?.category,
+      family: solixProductFamily({ product_code: record.product_code, category: label?.category })
+    };
+    this.caps = detectSolixCapabilities(record, this.identity_.category);
+  }
+  /**
+   * The device's {@link SolixProductFamily} — the classification a caller branches on to SORT devices
+   * (a site's power stations vs its meters), the Solix analogue of eufy's `isHomeBase()`. Distinct from
+   * {@link has}, which answers what the device can DO; family answers what KIND of device it is.
+   */
+  get family() {
+    return this.identity_.family;
+  }
+  /** All capabilities this device carries. */
+  get capabilities() {
+    return [...this.caps];
+  }
+  /** Whether the device carries a capability — the only correct way to branch on behaviour. */
+  has(capability) {
+    return this.caps.has(capability);
+  }
+  /**
+   * Merge a live telemetry reading (a `SolixMqtt` `reading` event) so accessors reflect it. Takes the
+   * WHOLE reading, not just its values, and drops one addressed to a different device: the documented
+   * wiring is `mqtt.on("reading", r => device.applyReading(r))`, and one MQTT stream carries every
+   * watched meter on the account — so without this filter two meters would cross-feed each other's floats.
+   * A reading with no `deviceSn` (a hand-built one) is accepted as-is.
+   */
+  applyReading(reading) {
+    if (reading.deviceSn && reading.deviceSn !== this.serial)
+      return;
+    this.values = { ...this.values, ...reading.values };
+  }
+  /** All decoded float telemetry channels from the latest applied reading (raw, `channel_<tag>` keys). */
+  telemetry() {
+    return { ...this.values };
+  }
+  identity() {
+    return { ...this.identity_ };
+  }
+  firmware() {
+    return this.record.device_sw_version ? { version: this.record.device_sw_version } : void 0;
+  }
+  connectivity() {
+    if (!this.has("connectivity"))
+      return void 0;
+    const rssi = this.record.rssi != null ? Number(this.record.rssi) : void 0;
+    return {
+      online: !!this.record.wifi_online,
+      rssi: Number.isFinite(rssi) ? rssi : void 0,
+      ssid: this.record.wifi_name
+    };
+  }
+  /**
+   * The members-derived `energyMeter` reads, or `undefined` when the device has no meter. Each getter is
+   * installed only for a tag this device has actually reported, and reads `this.values` LIVE — a handle
+   * held across an {@link applyReading} reflects the newer values. Getter INSTALLATION is fixed at the
+   * time of this call, so re-call it to pick up a tag first seen since.
+   */
+  energyMeter() {
+    if (!this.has("energyMeter"))
+      return void 0;
+    return bindMembers(SOLIX_ENERGY_METER_MEMBERS, this.meterDeps());
+  }
+  /**
+   * The {@link MemberDeps} the members engine needs: a read closure over the live values store, and the
+   * evidence gate (`ctx.paramIds`) rebuilt from the ff09 tags this device has reported. No `codec` — the
+   * codecs are eufy transport families and a Solix device belongs to none of them. The sink is a no-op:
+   * Solix telemetry is read-only, no member here dispatches a command.
+   */
+  meterDeps() {
+    const read = (name) => {
+      const v = this.values[name];
+      return v === void 0 ? void 0 : { name, paramType: 0, value: v, ts: Date.now() };
+    };
+    return { ctx: { channel: 0, paramIds: this.seenTags() }, sink: READ_ONLY_SINK, read };
+  }
+  /** The ff09 tags this device has reported, derived from the decoder's `channel_<hex>` keys. */
+  seenTags() {
+    const tags = /* @__PURE__ */ new Set();
+    for (const key of Object.keys(this.values)) {
+      const m = /^channel_([0-9a-f]+)$/.exec(key);
+      if (m)
+        tags.add(parseInt(m[1], 16));
+    }
+    return tags;
+  }
+};
+function resolveSolixCatalog(client, opts) {
+  return opts.catalog ? Promise.resolve(opts.catalog) : client.getProductCatalog().catch(() => []);
+}
+async function discoverSolixDevices(client, opts = {}) {
+  const [records, catalog] = await Promise.all([client.getDevices(), resolveSolixCatalog(client, opts)]);
+  return records.map((r) => new SolixDevice(r, { catalog }));
+}
+function sceneNum(v) {
+  if (typeof v === "number")
+    return Number.isFinite(v) ? v : void 0;
+  if (typeof v === "string" && v.trim() !== "") {
+    const n = Number(v);
+    return Number.isFinite(n) ? n : void 0;
+  }
+  return void 0;
+}
+function solarbankSceneReadings(scene) {
+  const list = scene.solarbank_info?.solarbank_list ?? [];
+  const out = [];
+  for (const sb of list) {
+    const deviceSn = typeof sb.device_sn === "string" ? sb.device_sn : void 0;
+    if (!deviceSn)
+      continue;
+    const values = {};
+    const temp = sceneNum(sb.bat_temperature);
+    if (temp !== void 0)
+      values.batteryTemperature = temp;
+    const soc = sceneNum(sb.bat_soc);
+    if (soc !== void 0)
+      values.batterySoc = soc;
+    if (Object.keys(values).length > 0)
+      out.push({ deviceSn, values });
+  }
+  return out;
+}
+
+// dist/model/solix-site.js
+var SolixSite = class {
+  id;
+  /** Friendly site name (e.g. "My Home"), or the site id when the record carries none. */
+  name;
+  /** Anker's site-type discriminator (e.g. 20 for a Solarbank-anchored home system), when present. */
+  powerSiteType;
+  record;
+  devices;
+  constructor(record, devices) {
+    this.record = record;
+    this.id = record.site_id;
+    this.name = record.site_name || record.site_id;
+    this.powerSiteType = record.power_site_type;
+    this.devices = devices;
+  }
+  /** The member device with this serial, if it belongs to the site. */
+  device(serial) {
+    return this.devices.find((d) => d.serial === serial);
+  }
+  /** Member devices of a given product {@link SolixProductFamily} — the grouping accessor. */
+  withFamily(family) {
+    return this.devices.filter((d) => d.family === family);
+  }
+  /** Member devices that carry a given capability (e.g. every `battery` in the system). */
+  withCapability(capability) {
+    return this.devices.filter((d) => d.has(capability));
+  }
+  /** The Solarbank / plug-in home-battery members of the system. */
+  solarbanks() {
+    return this.withFamily("solarbank");
+  }
+  /** The smart-meter (grid-CT) members of the system. */
+  smartMeters() {
+    return this.withFamily("smartMeter");
+  }
+  /** The portable power-station members of the system. */
+  powerStations() {
+    return this.withFamily("powerStation");
+  }
+};
+async function discoverSolixSites(client, opts = {}) {
+  const [sites, records, catalog] = await Promise.all([
+    client.getSites(),
+    client.getDevices(),
+    resolveSolixCatalog(client, opts)
+  ]);
+  const bySerial = new Map(records.map((r) => [r.device_sn, r]));
+  return sites.map((site) => {
+    const members = (site.site_device_list ?? []).map((entry) => {
+      const record = bySerial.get(entry.device_sn) ?? {
+        device_sn: entry.device_sn,
+        product_code: entry.device_model,
+        device_name: entry.device_name
+      };
+      return new SolixDevice(record, { catalog });
+    });
+    return new SolixSite(site, members);
+  });
+}
+
+// dist/client/map-channels.js
+var reader = (kind, decode) => (raw, codec) => {
+  const value = decode(raw, codec);
+  return value === void 0 ? void 0 : { kind, value };
+};
+var READER_BY_CHANNEL = {
+  MAP_DATA: reader("plane", decodeVacuumMap),
+  ROOM_OUTLINE: reader("outline", decodeVacuumRoomOutline),
+  ROOM_PARAMS: reader("rooms", decodeVacuumRoomParams),
+  RESTRICTED_ZONE: reader("zones", decodeVacuumRestrictedZones),
+  DYNAMIC_DATA: reader("pose", decodeVacuumPose)
+};
+var DECODED_MAP_CHANNELS = Object.keys(READER_BY_CHANNEL);
+var READERS = new Map(DECODED_MAP_CHANNELS.map((name) => [BIZ_CHANNEL[name], READER_BY_CHANNEL[name]]));
+function decodeMapFrame(frame, codec) {
+  if (frame.offset !== 0)
+    return void 0;
+  return READERS.get(frame.channelId)?.(frame.payload, codec);
 }
 
 // dist/transport/p2p/command-router.js
@@ -14201,19 +15118,27 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
    * cameras from that second group streamed normally at level-1 — including one of the same firmware as an
    * own-session camera that delivered no video at all for a reason of its own. An expired grace therefore
    * separates nothing on this path, and a start failure on such a session is not evidence about it.
+   *
+   * Every `false` answer carries a `level2-unavailable` trace naming its reason, wherever the wait ended: a
+   * `terminal` outcome is the one already stated where the negotiation concluded, since that is where the
+   * cipher and the cause are known, and re-stating it here would double every settled negotiation.
    */
   async awaitLevel2Key(graceMs, graceFrom = "call") {
-    if (this.closed)
+    if (this.closed) {
+      this.trace({ phase: "level2-unavailable", reason: "session-closed" });
       return false;
+    }
     if (this.level2Key)
       return true;
-    if (!this.level2Pending)
+    if (!this.level2Pending) {
+      this.trace({ phase: "level2-unavailable", reason: "not-negotiating" });
       return false;
+    }
     const since = graceFrom === "call" ? Date.now() : this.connectedAtMs ?? Date.now();
     const remaining = graceMs - (Date.now() - since);
     if (remaining <= 0) {
       this.logger.debug(`[p2p] ${this.cfg.stationSn} no level-2 key and its ${graceMs}ms grace has elapsed`);
-      this.trace({ phase: "level2-absent", waitedMs: graceMs });
+      this.trace({ phase: "level2-unavailable", reason: "grace-elapsed", waitedMs: graceMs });
       return false;
     }
     this.logger.debug(`[p2p] ${this.cfg.stationSn} waiting up to ${remaining}ms for the level-2 key`);
@@ -14239,10 +15164,12 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
     });
     if (outcome === "timeout") {
       this.logger.debug(`[p2p] ${this.cfg.stationSn} level-2 key did not arrive within its grace`);
+      this.trace({ phase: "level2-unavailable", reason: "grace-elapsed", waitedMs: remaining });
     } else if (outcome === "terminal") {
       this.logger.debug(`[p2p] ${this.cfg.stationSn} level-2 negotiation concluded without a key`);
     } else if (outcome === "closed") {
       this.logger.debug(`[p2p] ${this.cfg.stationSn} session closed before the level-2 key arrived`);
+      this.trace({ phase: "level2-unavailable", reason: "session-closed" });
     }
     return outcome === "key";
   }
@@ -14293,6 +15220,7 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
     this.level2Negotiating = true;
     const generation = this.connectionGeneration;
     const cipherId = gatewayInfoCipherId(gwPayload);
+    this.trace({ phase: "level2-negotiating", cipherId });
     void (async () => {
       try {
         const eccPrivHex = await this.cfg.resolveCipherKey?.(cipherId);
@@ -14300,11 +15228,13 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
           return;
         if (!eccPrivHex) {
           this.logger.debug(`[p2p] ${this.cfg.stationSn} no ECC key for cipher_id ${cipherId}`);
+          this.trace({ phase: "level2-unavailable", reason: "no-cipher-key", cipherId });
           this.settleLevel2();
           return;
         }
         const key = deriveLevel2KeyFromGatewayInfo(gwPayload, eccPrivHex);
         if (!key) {
+          this.trace({ phase: "level2-unavailable", reason: "derivation-failed", cipherId });
           this.settleLevel2();
           this.emit("error", new Error(`level-2 key derivation failed (cipher_id ${cipherId})`));
           return;
@@ -14316,6 +15246,7 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
       } catch (e) {
         if (this.closed || generation !== this.connectionGeneration)
           return;
+        this.trace({ phase: "level2-unavailable", reason: "derivation-failed", cipherId });
         this.settleLevel2();
         this.emit("error", e instanceof Error ? e : new Error(String(e)));
       }
@@ -14383,6 +15314,11 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
       if (host && !this.closed)
         this.selfAddress = { host, port: boundPort };
     });
+    this.trace({
+      phase: "lookup-channels",
+      local: !this.cfg.noBroadcast || this.cfg.localAddress !== void 0,
+      cloud: this.cfg.dskKey !== void 0 && (this.cfg.cloudAddresses?.length ?? 0) > 0
+    });
     this.sendLookups();
     this.lookupTimer = setInterval(() => this.sendLookups(), LOOKUP_RETRY_MS);
     this.connectTimer = setTimeout(() => {
@@ -14465,8 +15401,6 @@ var P2PSession = class _P2PSession extends EventEmitter2 {
       for (const addr of this.cfg.cloudAddresses)
         this.send(addr, type, payload);
       this.logger.debug(`[p2p] ${this.cfg.stationSn} sendLookups: cloud -> ${this.cfg.cloudAddresses.map((a) => `${a.host}:${a.port}`).join(", ")} self=${this.selfAddress?.host}:${this.selfAddress?.port}`);
-    } else {
-      this.logger.debug(`[p2p] ${this.cfg.stationSn} sendLookups: NO cloud lookup sent (dskKey=${!!this.cfg.dskKey} cloudAddresses=${this.cfg.cloudAddresses?.length ?? 0})`);
     }
   }
   /**
@@ -15666,19 +16600,23 @@ function parseFf09SettingsResponse(plain) {
   if (plain.length < 1)
     throw new Error("ff09: settings response too short (missing status byte)");
   const status = plain[0];
+  const fields = walkFf09Tlv(plain, 1, plain.length);
+  return { status, fields };
+}
+function walkFf09Tlv(buf, start, end) {
   const fields = /* @__PURE__ */ new Map();
-  let i = 1;
-  while (i + 2 <= plain.length) {
-    const sep = plain[i];
-    if (sep === 0)
+  let i = start;
+  while (i + 2 <= end) {
+    const tag2 = buf[i];
+    if (tag2 === 0)
       break;
-    const len = plain[i + 1];
-    if (i + 2 + len > plain.length)
+    const len = buf[i + 1];
+    if (i + 2 + len > end)
       break;
-    fields.set(sep, plain.subarray(i + 2, i + 2 + len));
+    fields.set(tag2, buf.subarray(i + 2, i + 2 + len));
     i += 2 + len;
   }
-  return { status, fields };
+  return fields;
 }
 function readFf09U16LE(field, name) {
   if (!field || field.length < 2)
@@ -16332,8 +17270,9 @@ var LiveStream = class extends EventEmitter3 {
    * Stop re-issuing the media start once this camera's own media has arrived, on an attached camera.
    *
    * The nudge differs by topology and only one branch is a ping: an own-session camera sends a small
-   * keepalive, while an attached camera has no such state and re-sends the FULL media start. On a station that
-   * serves one camera at a time that restart re-asserts this channel against whatever else is warm, so two
+   * keepalive, while an attached camera has no such state and re-sends the FULL media start. Over one session,
+   * which serves one camera at a time, that restart re-asserts this channel against whatever else is warm on
+   * it, so two
    * attached streams restart every interval and contend for the station continuously — measured on a real base
    * as a full start every 3 s from each.
    *
@@ -16381,10 +17320,12 @@ var LiveStream = class extends EventEmitter3 {
       if (!this.listening || this.kaTimer)
         return;
       if (this.opts.reassertWanted?.() === false) {
+        this.trace({ phase: "channel-silent", silentMs: stallMs, outcome: "declined" });
         this.logger.debug(`[live ch${this.channel}] no own media for ${stallMs}ms, and its owner does not want this channel re-asserted \u2014 staying quiet`);
         this.armStallWatch();
         return;
       }
+      this.trace({ phase: "channel-silent", silentMs: stallMs, outcome: "reasserted" });
       this.logger.debug(`[live ch${this.channel}] no own media for ${stallMs}ms \u2014 re-asserting this camera's channel`);
       this.sendStart();
       this.kaTimer = setInterval(() => this.sendStart(), keepAliveMs);
@@ -16498,7 +17439,7 @@ var LiveStream = class extends EventEmitter3 {
    *
    * The match is UNCONDITIONAL, however long a station serves another camera instead of this one.
    *
-   * A station serving one camera at a time hands a newly opened camera nothing but its sibling's frames until
+   * One session serving one camera at a time hands a newly opened camera nothing but its sibling's frames until
    * it switches, so "no media of my own yet, plenty for someone else" is what an ordinary handover looks like
    * and does not distinguish a station that tags differently from one that is simply busy.
    *
@@ -16605,10 +17546,12 @@ async function captureSnapshotFromShared(source, opts = {}) {
   const timeoutMs = opts.timeoutMs ?? 2e4;
   const collectMs = opts.collectMs ?? 1500;
   const skip = opts.skipKeyframes ?? 1;
+  opts.signal?.throwIfAborted();
   const consumer = source.attach();
   const primed = consumer.primed;
+  let burst;
   try {
-    const burst = await new Promise((resolve, reject) => {
+    burst = await new Promise((resolve, reject) => {
       const bufs = [];
       let sets = source.parameterSets;
       let codec = "h264";
@@ -16643,6 +17586,10 @@ async function captureSnapshotFromShared(source, opts = {}) {
         cleanup();
         reject(new LiveSnapshotUnavailableError("source-failed", `source ended before a keyframe (state: ${source.state})`));
       };
+      const onAbandoned = () => {
+        cleanup();
+        reject(opts.signal?.reason);
+      };
       const cleanup = () => {
         clearTimeout(timer);
         if (settle)
@@ -16650,19 +17597,21 @@ async function captureSnapshotFromShared(source, opts = {}) {
         consumer.off("video", onVideo);
         consumer.off("error", onError);
         consumer.off("stop", onStop);
+        opts.signal?.removeEventListener("abort", onAbandoned);
       };
       consumer.on("video", onVideo);
       consumer.on("error", onError);
       consumer.on("stop", onStop);
-    });
-    return await annexbToJpeg(primeForDecode(burst.h264, burst.sets, burst.codec), {
-      logger: opts.logger ?? noopLogger,
-      level: opts.ffmpegLevel,
-      executable: opts.ffmpegPath
+      opts.signal?.addEventListener("abort", onAbandoned, { once: true });
     });
   } finally {
     consumer.detach();
   }
+  return annexbToJpeg(primeForDecode(burst.h264, burst.sets, burst.codec), {
+    logger: opts.logger ?? noopLogger,
+    level: opts.ffmpegLevel,
+    executable: opts.ffmpegPath
+  });
 }
 async function recordClip(session, seconds, opts = {}) {
   const timeoutMs = opts.timeoutMs ?? 2e4;
@@ -17540,6 +18489,8 @@ var SharedLiveSource = class {
     this.configuredFrom = void 0;
     this.ring = [];
     this._state = state;
+    if (state === "stopped")
+      this.opts.onStopped?.();
     if (startFailed && report)
       this.opts.onStartFailed?.();
   }
@@ -17622,14 +18573,14 @@ var SessionManager = class {
     this.logger = opts.logger ?? noopLogger;
   }
   /** The live session for a station, or `undefined` if not open. */
-  get(parentSn) {
-    return this.entries.get(parentSn)?.session;
+  get(key) {
+    return this.entries.get(key)?.session;
   }
-  /** Serials of stations with a live session. */
+  /** Keys of the open sessions. */
   keys() {
     return [...this.entries].filter(([, e]) => e.session).map(([sn]) => sn);
   }
-  /** A plain `Map<parentSn, P2PSession>` snapshot of the live sessions (for `getSessions()` / tests). */
+  /** A plain `Map<key, P2PSession>` snapshot of the open sessions (for `getSessions()` / tests). */
   liveSessions() {
     const m = /* @__PURE__ */ new Map();
     for (const [sn, e] of this.entries)
@@ -17637,56 +18588,77 @@ var SessionManager = class {
         m.set(sn, e.session);
     return m;
   }
-  /** Get or create the lifecycle entry for a station. */
-  entry(parentSn) {
-    let e = this.entries.get(parentSn);
+  /**
+   * Get or create the lifecycle entry under `key`, recording which station it connects to. An existing
+   * entry keeps the station it was opened with — the key owns one connection for its lifetime, and a
+   * later caller passing a different station would otherwise re-point a live entry's power tier.
+   */
+  entry(key, station) {
+    let e = this.entries.get(key);
     if (!e) {
-      e = { retained: 0, holdTimers: /* @__PURE__ */ new Set(), idle: new Timer() };
-      this.entries.set(parentSn, e);
+      e = { station, retained: 0, holdTimers: /* @__PURE__ */ new Set(), idle: new Timer() };
+      this.entries.set(key, e);
     }
     return e;
   }
-  /** Register an already-built session for test seeding or an externally assembled connection. */
-  register(parentSn, session) {
-    this.entry(parentSn).session = session;
+  /**
+   * Register an already-built session for test seeding or an externally assembled connection.
+   *
+   * `station` defaults to the key, which is safe HERE and nowhere else in this class: the paths that open a
+   * session under a key that is not a station serial all go through {@link acquire}, which requires it. A
+   * caller seeding one under such a key must pass it.
+   */
+  register(key, session, station = key) {
+    this.entry(key, station).session = session;
   }
   /**
-   * Ensure a session to `parentSn` is open, building it via `factory` if cold. Concurrent calls for the
+   * Ensure a session to `key` is open, building it via `factory` if cold. Concurrent calls for the
    * same cold station share ONE connect (the `connecting` promise); `factory` builds + wires + awaits
    * `connect()` and resolves the connected session.
    */
-  async acquire(parentSn, factory) {
-    const e = this.entry(parentSn);
+  async acquire(key, factory, station) {
+    const e = this.entry(key, station);
     if (e.connecting) {
-      this.logger.debug(`[session ${parentSn}] connecting \u2014 joining in-flight open`);
+      this.logger.debug(`[session ${key}] connecting \u2014 joining in-flight open`);
       return e.connecting;
     }
     if (e.session)
       return e.session;
-    this.logger.debug(`[session ${parentSn}] connecting now (on demand)`);
+    this.logger.debug(`[session ${key}] connecting now (on demand)`);
     const generation = this.generation;
     const p = factory((session) => e.session = session);
     e.connecting = p;
     try {
       const session = await p;
-      if (generation !== this.generation || this.entries.get(parentSn) !== e) {
+      if (generation !== this.generation || this.entries.get(key) !== e) {
         await session.close();
-        throw new SessionSupersededError(`P2P session start superseded for station ${parentSn}`);
+        throw new SessionSupersededError(`P2P session start superseded for ${key}`);
       }
       e.session ??= session;
-      this.logger.debug(`[session ${parentSn}] connected`);
+      this.logger.debug(`[session ${key}] connected`);
       return e.session;
     } finally {
       if (e.connecting === p)
         e.connecting = void 0;
     }
   }
-  /** Add a reason to stay connected; cancels a pending idle-close. */
-  retain(parentSn) {
-    const e = this.entry(parentSn);
+  /**
+   * Add a reason to stay connected; cancels a pending idle-close.
+   *
+   * Refused when nothing is open under `key`, for the reason {@link release} gives in the other direction: a
+   * retain names a session that was acquired, and one that names nothing would file an entry with no
+   * connection behind it. {@link hold} is the path that legitimately creates one, and it opens the entry
+   * itself before retaining it.
+   */
+  retain(key) {
+    const e = this.entries.get(key);
+    if (!e) {
+      this.logger.warn(`[session ${key}] retain on a session that is not open \u2014 ignored`);
+      return;
+    }
     e.retained++;
     if (e.idle.pending)
-      this.logger.debug(`[session ${parentSn}] in use again \u2014 idle-detach cancelled`);
+      this.logger.debug(`[session ${key}] in use again \u2014 idle-detach cancelled`);
     e.idle.cancel();
   }
   /**
@@ -17697,44 +18669,50 @@ var SessionManager = class {
    * from scratch or complete a deferred reset a real viewer has not yet earned. Clamping to zero did
    * both silently.
    */
-  release(parentSn) {
-    const e = this.entries.get(parentSn);
+  release(key) {
+    const e = this.entries.get(key);
     if (!e)
       return;
     if (e.retained === 0) {
-      this.logger.warn(`[session ${parentSn}] release with nothing retained \u2014 ignored`);
+      this.logger.warn(`[session ${key}] release with nothing retained \u2014 ignored`);
       return;
     }
     e.retained -= 1;
     if (e.reset && e.retained <= e.holdTimers.size) {
-      void this.autoClose(parentSn).catch((error) => this.logger.error(`[session ${parentSn}] deferred reset failed`, error));
+      void this.autoClose(key).catch((error) => this.logger.error(`[session ${key}] deferred reset failed`, error));
       return;
     }
     if (e.retained === 0)
-      this.armIdle(parentSn, e);
+      this.armIdle(key, e);
   }
   /**
    * Hold a session warm for `commandKeepAliveMs` after a control command, then release. A burst of
    * commands each re-holds before the previous release fires, so the session never idles mid-burst.
    */
-  bumpCommand(parentSn) {
-    this.hold(parentSn, this.opts.commandKeepAliveMs ?? COMMAND_KEEPALIVE_MS);
+  bumpCommand(key, station) {
+    this.hold(key, this.opts.commandKeepAliveMs ?? COMMAND_KEEPALIVE_MS, station);
   }
   /**
-   * Retain a station and release it again after `ms` — the primitive behind command-keepalive and event
+   * Retain a session and release it again after `ms` — the primitive behind command-keepalive and event
    * pre-warm, and the only way to hold one open without an attachment to release it.
    *
+   * `station` is required rather than defaulted from the key, because this is the one path that can
+   * CREATE an entry: a pre-warm takes its hold before the open. An entry filed under a media key with
+   * that key as its own station would be asked for the power tier of a serial that does not exist, be
+   * answered `wired`, and never idle-detach — which on a battery station is the drain this class exists
+   * to prevent, and is invisible until the battery is flat.
+   *
    * The timer is owned by the entry, so {@link discard} cancels it. That ownership is the point: keyed
    * only by serial, an expiring hold would otherwise outlive the entry it was taken on and release a
    * retain counted by the SUCCESSOR entry — dropping a live viewer's count and arming an idle-detach
    * underneath it.
    */
-  hold(parentSn, ms) {
-    const entry = this.entry(parentSn);
-    this.retain(parentSn);
+  hold(key, ms, station) {
+    const entry = this.entry(key, station);
+    this.retain(key);
     const timer = setTimeout(() => {
       entry.holdTimers.delete(timer);
-      this.release(parentSn);
+      this.release(key);
     }, ms);
     timer.unref?.();
     entry.holdTimers.add(timer);
@@ -17743,29 +18721,29 @@ var SessionManager = class {
    * Arm the idle-close timer for a station whose retain count just reached zero. A wired station with
    * an infinite window is left persistent (no timer). Any subsequent {@link retain} cancels it.
    */
-  armIdle(parentSn, e) {
+  armIdle(key, e) {
     e.idle.cancel();
-    if ((this.opts.poweredFor?.(parentSn) ?? "wired") !== "battery") {
-      this.logger.debug(`[session ${parentSn}] idle (nothing retained) \u2014 staying persistent (wired)`);
+    if ((this.opts.poweredFor?.(e.station) ?? "wired") !== "battery") {
+      this.logger.debug(`[session ${key}] idle (nothing retained) \u2014 staying persistent (wired)`);
       return;
     }
     const idleMs = this.opts.batteryIdleMs ?? BATTERY_IDLE_MS;
-    this.logger.debug(`[session ${parentSn}] idle (nothing retained) \u2014 detaching in ${idleMs}ms unless reused`);
-    e.idle.arm(idleMs, () => this.onIdle(parentSn));
+    this.logger.debug(`[session ${key}] idle (nothing retained) \u2014 detaching in ${idleMs}ms unless reused`);
+    e.idle.arm(idleMs, () => this.onIdle(key));
   }
   /**
    * Close a station's session once its idle window elapses with nothing retained, letting the device sleep.
    * Re-checks the count first (activity between the timer firing and now re-arms instead). Dropping the
    * entry here and the session's own `close` → {@link remove} are both idempotent.
    */
-  onIdle(parentSn) {
-    const e = this.entries.get(parentSn);
+  onIdle(key) {
+    const e = this.entries.get(key);
     if (!e)
       return;
     if (e.retained > 0)
       return;
-    this.logger.debug(`[session ${parentSn}] idle window elapsed \u2014 disconnecting now (device can sleep)`);
-    void this.autoClose(parentSn).catch((error) => this.logger.error(`[session ${parentSn}] idle detach failed`, error));
+    this.logger.debug(`[session ${key}] idle window elapsed \u2014 disconnecting now (device can sleep)`);
+    void this.autoClose(key).catch((error) => this.logger.error(`[session ${key}] idle detach failed`, error));
   }
   /**
    * Close a station the manager itself decided to close, and announce it.
@@ -17783,23 +18761,23 @@ var SessionManager = class {
    * An entry that never carried a session is still torn down, but silently: a pre-warm whose open failed
    * leaves one behind, and announcing it would report a station closed that was never reported open.
    */
-  async autoClose(parentSn) {
-    const entry = this.discard(parentSn);
+  async autoClose(key) {
+    const entry = this.discard(key);
     if (!entry)
       return;
     if (entry.session)
-      this.opts.onAutoClose?.(parentSn);
+      this.opts.onAutoClose?.(key);
     await this.closeEntry(entry);
   }
   /** Drop a station's entry + timer (called from the session's `close` handler). Idempotent. */
-  remove(parentSn) {
-    const entry = this.discard(parentSn);
+  remove(key) {
+    const entry = this.discard(key);
     if (entry)
       this.settleReset(entry);
   }
   /** Close one station now and discard its lifecycle entry. */
-  async close(parentSn) {
-    const entry = this.discard(parentSn);
+  async close(key) {
+    const entry = this.discard(key);
     if (entry)
       await this.closeEntry(entry);
   }
@@ -17813,12 +18791,12 @@ var SessionManager = class {
    * Both branches close through {@link autoClose}: the caller asked for a recycle, not for the station's
    * live sources to be dropped, so it does not clean up after one — exactly like the idle path.
    */
-  resetWhenUnused(parentSn) {
-    const entry = this.entries.get(parentSn);
+  resetWhenUnused(key) {
+    const entry = this.entries.get(key);
     if (!entry)
       return Promise.resolve();
     if (entry.retained <= entry.holdTimers.size)
-      return this.autoClose(parentSn);
+      return this.autoClose(key);
     entry.reset ??= Promise.withResolvers();
     return entry.reset.promise;
   }
@@ -17850,22 +18828,22 @@ var SessionManager = class {
    * discarded entry owns no live timer, which is what stops a deferred release from landing on whatever
    * entry next occupies this serial.
    */
-  discard(parentSn) {
-    const entry = this.entries.get(parentSn);
+  discard(key) {
+    const entry = this.entries.get(key);
     if (!entry)
       return void 0;
     entry.idle.cancel();
     for (const timer of entry.holdTimers)
       clearTimeout(timer);
     entry.holdTimers.clear();
-    this.entries.delete(parentSn);
+    this.entries.delete(key);
     return entry;
   }
   /** Close every session and clear all timers. */
   async closeAll() {
     this.generation++;
-    const entries = [...this.entries.keys()].flatMap((parentSn) => {
-      const entry = this.discard(parentSn);
+    const entries = [...this.entries.keys()].flatMap((key) => {
+      const entry = this.discard(key);
       return entry ? [entry] : [];
     });
     const results = await Promise.allSettled(entries.map((entry) => this.closeEntry(entry)));
@@ -18855,7 +19833,6 @@ var FragmentRecording = class extends EventEmitter6 {
 
 // dist/transport/p2p/command-router.js
 var DIRECT_CMD_SENDS = 5;
-var CONNECT_WAIT_MS = 2e4;
 function abortable(work, signal) {
   if (!signal)
     return work;
@@ -18869,6 +19846,11 @@ function abortable(work, signal) {
 }
 var LEVEL2_GRACE_MS = 25e3;
 var LEVEL2_SETTLE_MS = 8e3;
+var P2P_STATION_WAITS = {
+  connect: CONNECT_TIMEOUT_MS,
+  level2Grace: LEVEL2_GRACE_MS,
+  level2Settle: LEVEL2_SETTLE_MS
+};
 var RTSP_URL_READ_TIMEOUT_MS = 12e3;
 var SHARED_LIVE_OPT_KEYS = [
   "eccPrivateKey",
@@ -18886,7 +19868,7 @@ function sameLiveOpt(a, b) {
 }
 var P2PCommandRouter = class _P2PCommandRouter {
   deps;
-  /** Per-station P2P session lifecycle: on-demand open + battery-aware idle-detach + refcount. */
+  /** P2P session lifecycle: on-demand open + battery-aware idle-detach + refcount, per session key. */
   manager;
   /** Error objects already forwarded while a station startup awaits the same session signal. */
   reportedErrors = /* @__PURE__ */ new WeakSet();
@@ -18894,6 +19876,21 @@ var P2PCommandRouter = class _P2PCommandRouter {
   liveSources = /* @__PURE__ */ new Map();
   /** The options each live source was built from, so a later caller's conflicting ones can be reported. */
   liveSourceOpts = /* @__PURE__ */ new Map();
+  /**
+   * The session each live source pulls over — the station's own serial, or the source's own media
+   * session key.
+   *
+   * Written the instant the choice is made and BEFORE the connection is opened, which is what makes it
+   * a reservation rather than a record. Two cameras started together (the four-tile case this feature
+   * exists for) would otherwise both find the station's session free: a consumer attaches only after
+   * `sharedLiveSourceFor` returns, so neither is visible to the other through consumer counts, and both
+   * would take the shared connection and contend on it.
+   *
+   * A station entry is kept as well as a media one, because "is the station's own session already
+   * claimed" is the question being asked, and an entry that is present but not yet in
+   * {@link liveSources} is a claim in flight.
+   */
+  liveSessionKeys = /* @__PURE__ */ new Map();
   /**
    * The open talkback per `${parentSn}:${channel}`, if any. The device plays one audio stream at a
    * time and the session carries one audio sequence, so this path is exclusive where a live pull is
@@ -18907,7 +19904,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
     this.manager = new SessionManager({
       poweredFor: deps.poweredFor,
       logger: deps.logger,
-      onAutoClose: (parentSn) => this.tearDownStation(parentSn),
+      onAutoClose: (key) => _P2PCommandRouter.isMediaSessionKey(key) ? this.tearDownMediaSession(key) : this.tearDownStation(key),
       ...deps.sessionIdle
     });
   }
@@ -18920,6 +19917,14 @@ var P2PCommandRouter = class _P2PCommandRouter {
     }
     return normalized;
   }
+  /**
+   * Emit a live trace under a station session's handle, for work this router does ON that session before
+   * the session itself records anything — reaching the station, and resolving what a device is on it. Same
+   * handle as everything the session goes on to trace, which is what groups one attempt.
+   */
+  traceOnStation(session, trace) {
+    traceLiveStart(this.deps.logger ?? noopLogger, trace, session.traceId);
+  }
   /**
    * Whether this transport stack drives `dev`'s `ff09-*` commands — true when the device has its own
    * usable P2P endpoint (a non-empty `p2p_did`). The command sink asks each stack this to route a
@@ -18931,7 +19936,10 @@ var P2PCommandRouter = class _P2PCommandRouter {
   static claimsDevice(dev) {
     return typeof dev.p2pDid === "string" && dev.p2pDid.length > 0;
   }
-  /** Stations with a live P2P session (a snapshot; mutate via the lifecycle methods, not this map). */
+  /**
+   * The open P2P sessions by key — a station's own under its serial, a camera's media session under
+   * `<stationSn>#live:<channel>` (a snapshot; mutate via the lifecycle methods, not this map).
+   */
   getSessions() {
     return this.manager.liveSessions();
   }
@@ -18943,16 +19951,16 @@ var P2PCommandRouter = class _P2PCommandRouter {
    *
    * One hold, taken before the open so a slow connect can't idle-close mid-flight. It expires on its
    * own, which arms the station's idle window rather than closing the session, per {@link PREWARM_MS}.
-   * A second hold after the open would buy nothing: {@link openStation} returns once the socket is bound
+   * A second hold after the open would buy nothing: {@link openSession} returns once the socket is bound
    * and the lookups are away, not once the peer has answered, so both would expire together.
    *
    * Best-effort — a failed open surfaces via `onError`. A {@link SessionSupersededError} does not: the
    * session was deliberately closed underneath a speculative open, which is not a fault to report.
    */
   async prewarm(parentSn, ms = PREWARM_MS) {
-    this.manager.hold(parentSn, ms);
+    this.manager.hold(parentSn, ms, parentSn);
     try {
-      await this.openStation(parentSn);
+      await this.openSession(parentSn, parentSn);
     } catch (e) {
       if (e instanceof SessionSupersededError)
         return;
@@ -18969,6 +19977,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
       src.dispose();
     this.liveSources.clear();
     this.liveSourceOpts.clear();
+    this.liveSessionKeys.clear();
     await this.manager.closeAll();
   }
   /** This serial's loaded record, or `undefined` — the one place the cached list is searched by serial. */
@@ -19010,8 +20019,55 @@ var P2PCommandRouter = class _P2PCommandRouter {
    * when present, else the freshest private IP in the record ({@link freshestLanIp}) — so P2P works
    * on-LAN even when broadcast is blocked (AP isolation) or the record's `ip_addr` went stale.
    */
-  async openStation(parentSn) {
-    return this.manager.acquire(parentSn, async (register) => {
+  /**
+   * The key a camera's own media session is filed under, distinct from every station serial because a
+   * serial contains no `#`.
+   */
+  static mediaSessionKey(parentSn, channel) {
+    return `${parentSn}#live:${channel}`;
+  }
+  /** Whether `key` names a media session rather than a station's own. */
+  static isMediaSessionKey(key) {
+    return key.includes("#live:");
+  }
+  /**
+   * Open (or reuse) a SECOND connection to a station, carrying one camera's media and nothing else.
+   *
+   * One session serves one camera: a station fans its cameras over a session and answers the most recent
+   * start on it, so two cameras down one tunnel take it from each other in turn. Another connection is
+   * how a station serves another camera.
+   *
+   * The hardware was shown to do this before the SDK did. A first-party display showing four tiles was
+   * captured opening one PPCS session per camera, with three cameras' video arriving in the same second
+   * at 2304x1296, 1600x1200 and 3840x2160 — three geometries at once, which no composed stream can be.
+   * Reproduced here afterwards on a base carrying two attached cameras, one at 3840x2160, both holding
+   * full frame rate at once over a session each, where the same pair down one session could only take
+   * turns.
+   *
+   * It carries media alone. The station announces its state to every client that connects, so a session
+   * wired to the same fan-out would report every event a second time; {@link makeSession} leaves this one
+   * unannounced, and the station's own session stays the single source of connection state, control
+   * notifications and frames.
+   *
+   * The level-2 key is waited for here on the same terms the station's own session gets, because a
+   * connection is not usable for this without one: an attached camera's media start has no level-1 form,
+   * so a start issued before the key arrives is dropped as `media-command-unsent`, and the stream then
+   * shows nothing until a later keepalive tick happens to find the key. A connected session that cannot
+   * carry the start is not a connected session, so this refuses rather than returning one.
+   */
+  async openMediaSession(parentSn, channel, signal) {
+    const session = await this.openSession(_P2PCommandRouter.mediaSessionKey(parentSn, channel), parentSn);
+    let ready = await abortable(session.awaitLevel2Key(LEVEL2_GRACE_MS, "call"), signal);
+    if (!ready && session.repromptLevel2Key()) {
+      ready = await abortable(session.awaitLevel2Key(LEVEL2_GRACE_MS, "call"), signal);
+    }
+    if (!ready)
+      throw new StationKeyUnavailableError(parentSn);
+    return session;
+  }
+  /** Open (or reuse) the session filed under `key`, dialling `parentSn`'s endpoint. */
+  async openSession(key, parentSn) {
+    return this.manager.acquire(key, async (register) => {
       const stationDev = this.recordFor(parentSn);
       if (!stationDev)
         throw new Error(`station ${parentSn} is not in the device list`);
@@ -19026,11 +20082,11 @@ var P2PCommandRouter = class _P2PCommandRouter {
         this.deps.onError(e instanceof Error ? e : new Error(String(e)));
       }
       const localAddress = this.deps.localAddresses?.[parentSn] ?? freshestLanIp(raw);
-      const session = this.makeSession(parentSn, did, raw, dskKey, localAddress);
+      const session = this.makeSession(parentSn, did, raw, dskKey, localAddress, key, key === parentSn);
       register(session);
       await session.connect();
       return session;
-    });
+    }, parentSn);
   }
   /**
    * Build + wire a {@link P2PSession} for a station (NOT yet connected — the caller awaits `connect()`).
@@ -19043,8 +20099,14 @@ var P2PCommandRouter = class _P2PCommandRouter {
    *
    * The `close` handler drops the session from the {@link SessionManager} and disposes any shared live
    * source riding this station (consumers get `stop`; a later attach rebuilds via the factory).
+   *
+   * A session filed under a media key is wired for errors and its own teardown ONLY. Connection state,
+   * level-2 readiness and inbound frames all reach the owner through the station's own session, and a
+   * station announces those to every client that connects — so fanning a second connection's copies out
+   * under the same station serial would report each one twice, and a close would tear down the station
+   * while its own session is still serving.
    */
-  makeSession(stationSn, did, raw, dskKey, localAddress) {
+  makeSession(stationSn, did, raw, dskKey, localAddress, key, announces) {
     const conn = raw?.p2p_conn ?? raw?.app_conn;
     const adminUserId = raw?.member?.admin_user_id || this.deps.mega.auth?.userId || "";
     const session = new P2PSession({
@@ -19060,7 +20122,15 @@ var P2PCommandRouter = class _P2PCommandRouter {
         let ecc;
         try {
           const ciphers = await this.deps.mega.getCiphers([cipherId], adminUserId, stationSn);
-          ecc = ciphers.find((c) => Number(c.cipher_id) === cipherId)?.ecc_private_key ?? ciphers[0]?.ecc_private_key;
+          ecc = ciphers.find((c) => Number(c.cipher_id) === cipherId)?.ecc_private_key;
+          if (ecc === void 0 && ciphers[0]?.ecc_private_key !== void 0) {
+            ecc = ciphers[0].ecc_private_key;
+            this.traceOnStation(session, {
+              phase: "cipher-fallback",
+              cipherId,
+              answeredCipherId: Number(ciphers[0].cipher_id)
+            });
+          }
         } catch (e) {
           this.deps.onError(e instanceof Error ? e : new Error(String(e)));
         }
@@ -19070,6 +20140,14 @@ var P2PCommandRouter = class _P2PCommandRouter {
       },
       logger: this.deps.logger ?? noopLogger
     });
+    session.on("error", (e) => this.reportError(e));
+    if (!announces) {
+      session.on("close", () => {
+        if (this.manager.get(key) === session)
+          this.tearDownMediaSession(key);
+      });
+      return session;
+    }
     session.on("connect", () => {
       if (this.manager.get(stationSn) === session)
         this.deps.onConnect(stationSn);
@@ -19079,7 +20157,6 @@ var P2PCommandRouter = class _P2PCommandRouter {
         return;
       this.tearDownStation(stationSn);
     });
-    session.on("error", (e) => this.reportError(e));
     session.on("level2Ready", ({ cipherId }) => this.deps.onLevel2Ready(stationSn, cipherId));
     session.on("data", (f) => this.deps.onFrame(stationSn, f));
     return session;
@@ -19090,7 +20167,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
    */
   async ensureStation(parentSn, signal) {
     try {
-      const session = await this.openStation(parentSn);
+      const session = await this.openSession(parentSn, parentSn);
       if (session.isConnected)
         return;
       await new Promise((resolve, reject) => {
@@ -19138,7 +20215,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
     const dev = this.recordFor(sn);
     if (!dev)
       throw new Error(`device ${sn} not found`);
-    await this.openStation(this.stationKeyFor(dev));
+    await this.openSession(this.stationKeyFor(dev), this.stationKeyFor(dev));
     return dev;
   }
   /**
@@ -19214,19 +20291,19 @@ var P2PCommandRouter = class _P2PCommandRouter {
     return {
       snapshotLive: async (opts) => {
         const source = await this.sharedLiveSourceFor(sn, opts ?? {});
-        return abortable(captureSnapshotFromShared(source, {
+        return captureSnapshotFromShared(source, {
           ...opts,
           logger: this.deps.logger ?? noopLogger,
           ffmpegLevel: this.deps.ffmpegLogLevel,
           ffmpegPath: this.deps.ffmpegPath
-        }), opts?.signal);
+        });
       },
       live: async (opts) => {
-        const source = await this.sharedLiveSourceFor(sn, opts);
+        const source = await this.sharedLiveSourceFor(sn, opts, true);
         return this.attachUnlessAborted(source, opts?.signal);
       },
       openReadable: async (opts) => {
-        const source = await this.sharedLiveSourceFor(sn, opts ?? {});
+        const source = await this.sharedLiveSourceFor(sn, opts ?? {}, true);
         return openReadableFromConsumer(this.attachUnlessAborted(source, opts?.signal), opts);
       },
       recordFragments: (opts) => this.recordFragments(sn, opts),
@@ -19367,10 +20444,17 @@ var P2PCommandRouter = class _P2PCommandRouter {
    * {@link releaseLingeringSiblings}. A pull with consumers is never touched. The release runs before the
    * reuse branch, so a reuse frees the station as a cold start does.
    *
+   * `mayOpenOwnSession` decides whether a camera that finds the station's own session claimed may open a
+   * connection of its own for it. Only the continuous-pull egresses pass it. A still must not: it wants one
+   * frame, and a socket plus a level-2 negotiation per thumbnail is a cost a tile refresh cannot justify —
+   * so a still asked for while a sibling is being watched contends as it always did, and the caller's
+   * retained image answers it. A live view still outranks a tile; what changed is that two live views no
+   * longer have to outrank each other.
+   *
    * The session goes into a {@link HeldSession} cell, so it can be replaced under a source that stays in
    * place.
    */
-  async sharedLiveSourceFor(sn, opts = {}) {
+  async sharedLiveSourceFor(sn, opts = {}, mayOpenOwnSession = false) {
     const { session, parentSn, channel, accountId, homeBaseAttached } = await this.resolveSession(sn, {
       waitLevel2: "soft",
       requireLevel2ForAttached: true,
@@ -19383,14 +20467,19 @@ var P2PCommandRouter = class _P2PCommandRouter {
       source = void 0;
     }
     this.releaseLingeringSiblings(parentSn, channel);
-    if (homeBaseAttached) {
-      const serving = this.occupiedSiblingChannel(parentSn, key);
-      if (serving !== void 0)
-        throw new StationBusyError(serving);
-    }
     if (!source) {
       const logger = this.deps.logger ?? noopLogger;
-      const held = { session };
+      const sessionKey = mayOpenOwnSession && homeBaseAttached && this.stationSessionInUse(parentSn, key) ? _P2PCommandRouter.mediaSessionKey(parentSn, channel) : parentSn;
+      this.liveSessionKeys.set(key, sessionKey);
+      let held;
+      try {
+        held = {
+          session: sessionKey === parentSn ? session : await this.openMediaSession(parentSn, channel, opts.signal)
+        };
+      } catch (error) {
+        this.liveSessionKeys.delete(key);
+        throw error;
+      }
       source = new SharedLiveSource({
         makeStream: (ctx) => new LiveStream(held.session, {
           channel,
@@ -19408,8 +20497,9 @@ var P2PCommandRouter = class _P2PCommandRouter {
         budgetGraceMs: opts.budgetGraceMs,
         logger,
         label: key,
-        onActive: () => this.manager.retain(parentSn),
-        onIdle: () => this.manager.release(parentSn),
+        onActive: () => this.manager.retain(sessionKey),
+        onIdle: () => this.manager.release(sessionKey),
+        onStopped: () => this.closeMediaSession(key),
         onStartFailed: () => this.onLiveStartFailed(sn, key),
         onSessionUnreachable: () => this.replaceUnreachableSession(sn, key, held)
       });
@@ -19424,14 +20514,25 @@ var P2PCommandRouter = class _P2PCommandRouter {
    * Tear down any pull on this station that is lingering for ANOTHER camera, before starting this one.
    *
    * A lingering pull has no consumers but is still held open, and on an attached camera holding it open means
-   * re-sending the full media start every keepalive tick. Two channels doing that at once on a station that
-   * serves one camera at a time leaves the new stream receiving nothing but the old camera's frames for as
-   * long as the linger lasts.
+   * re-sending the full media start every keepalive tick. Two channels doing that at once over ONE session,
+   * which serves one camera at a time, leaves the new stream receiving nothing but the old camera's frames
+   * for as long as the linger lasts.
    *
    * Several cameras genuinely being WATCHED together are never disturbed — the linger exists to make
    * re-opening the SAME camera cheap, and it keeps doing that. What it may not do is keep a camera nobody is
    * looking at competing with one somebody just asked for.
    *
+   * An `idle` source is skipped, because it is not a linger and holds nothing: it has never warmed, so it
+   * has sent no media start and is competing for nothing. Without that, two cameras opened at the same
+   * moment destroy each other — the second finds the first's source built but not yet attached to, reads
+   * zero consumers as a linger, and disposes the source its caller is holding. Which is the four-tile case
+   * this whole path exists for.
+   *
+   * A sibling lingering on a connection of its OWN is skipped for the same reason stated the other way: the
+   * contention this releases is contention over one session, and that sibling is not on this one. Dropping
+   * it would close a socket and throw away the cheap re-attach the linger exists to provide, to relieve a
+   * competition that is not happening.
+   *
    * A snapshot tile is nobody looking. Opening a live view in the Home app takes that cell fullscreen, so the
    * pulls refreshing the other cells are off screen, yet each goes on re-issuing its own media start every
    * retry tick — measured as four pulls warming together off one HomeBase, a live request landing 1.4 s later,
@@ -19445,28 +20546,49 @@ var P2PCommandRouter = class _P2PCommandRouter {
     for (const [key, source] of [...this.liveSources]) {
       if (!key.startsWith(`${parentSn}:`) || key === own || source.consumerCount > 0)
         continue;
-      (this.deps.logger ?? noopLogger).debug(`[live ${key}] releasing a pull nothing is attached to so ${own} can start \u2014 one station serves one camera at a time`);
+      if (source.state === "idle")
+        continue;
+      if (this.liveSessionKeys.get(key) !== parentSn)
+        continue;
+      (this.deps.logger ?? noopLogger).debug(`[live ${key}] releasing a pull nothing is attached to so ${own} can start \u2014 one session serves one camera at a time`);
       this.dropLiveSource(key);
     }
   }
   /**
-   * The channel a live viewer already holds on this station, if any, ignoring `key` itself.
+   * Whether another camera has already claimed this station's OWN session, ignoring `key`.
+   *
+   * The question a newcomer has to answer is not whether the station is busy — it can serve one camera
+   * per connection — but whether the connection it would otherwise share is taken. A camera on a media
+   * session of its own does not hold this one, so a station whose first camera has since stopped hands
+   * its own session to the next arrival rather than opening a socket beside an idle one.
+   *
+   * A claim counts while its source is still `idle`, source or no source. That is a start that has been
+   * handed to its caller but not yet attached to, and it is the only state in which two cameras asked for
+   * at the same moment can see each other: consumers attach after this method has already run for both.
+   *
+   * The cost is that a pull genuinely abandoned before its first attach goes on holding the station's own
+   * session, and the next camera pays for a connection of its own rather than reclaiming it. That is one
+   * socket against destroying a start someone is waiting on, which is not a close trade.
    *
    * A stopped source is skipped even when consumers are still attached to it. A failed start fails its
    * consumers without detaching them, so a caller still holding a dead handle leaves the count non-zero,
-   * and counting that as a viewer would refuse every later stream on the station until the client
-   * restarted. Only a source that can still deliver holds a place.
+   * and counting that as a viewer would put every later camera on a connection of its own until the
+   * client restarted. Only a source that can still deliver holds a place.
    */
-  occupiedSiblingChannel(parentSn, key) {
-    for (const [siblingKey, sibling] of this.liveSources) {
-      if (siblingKey === key || !siblingKey.startsWith(`${parentSn}:`))
+  stationSessionInUse(parentSn, key) {
+    for (const [siblingKey, sessionKey] of this.liveSessionKeys) {
+      if (siblingKey === key || sessionKey !== parentSn)
+        continue;
+      const sibling = this.liveSources.get(siblingKey);
+      if (!sibling)
+        return true;
+      if (sibling.state === "stopped")
         continue;
-      if (sibling.state === "stopped" || sibling.consumerCount === 0)
+      if (sibling.state !== "idle" && sibling.consumerCount === 0)
         continue;
-      const channel = Number(siblingKey.slice(parentSn.length + 1));
-      return Number.isFinite(channel) ? channel : void 0;
+      return true;
     }
-    return void 0;
+    return false;
   }
   /**
    * Whether the stream on `key` should re-assert its channel to hold the station.
@@ -19477,8 +20599,8 @@ var P2PCommandRouter = class _P2PCommandRouter {
    *  - Nothing attached: no. There is nobody to take the station for.
    *  - A live viewer attached: yes. That is the picture someone is looking at.
    *  - Held only for stills, while a sibling on this station has a live viewer: no. A still refreshes a
-   *    tile that is off screen while the live view is on it, and a station serving one camera at a time
-   *    cannot satisfy both. Measured: a still on a sibling halved a live view's frame rate for as long as
+   *    tile that is off screen while the live view is on it, and one session serving one camera at a time
+   *    cannot satisfy both — and a still does not open a connection of its own. Measured: a still on a sibling halved a live view's frame rate for as long as
    *    it took, and its own capture then took fifteen seconds because it was contending.
    *
    * A still with no live sibling re-asserts, so a tile refreshing on a quiet station is
@@ -19500,7 +20622,13 @@ var P2PCommandRouter = class _P2PCommandRouter {
     }
     return consumer;
   }
-  /** Dispose one cached live source and forget it, so the next acquisition builds a fresh one. */
+  /**
+   * Dispose one cached live source and forget it, so the next acquisition builds a fresh one. Its claim
+   * on a session goes with it, and a media session opened for this source alone is closed: nothing else
+   * can reach that connection, so leaving it open would hold a socket and a station keepalive for a
+   * camera no longer being pulled. A claim on the STATION's own session is released without closing
+   * anything — that connection carries the station's control traffic and outlives any one camera.
+   */
   dropLiveSource(key) {
     const source = this.liveSources.get(key);
     if (!source)
@@ -19508,6 +20636,34 @@ var P2PCommandRouter = class _P2PCommandRouter {
     source.dispose();
     this.liveSources.delete(key);
     this.liveSourceOpts.delete(key);
+    this.closeMediaSession(key);
+  }
+  /** Close and forget the media session `key`'s live source owned, if it owned one. */
+  closeMediaSession(key) {
+    const sessionKey = this.liveSessionKeys.get(key);
+    if (sessionKey === void 0)
+      return;
+    this.liveSessionKeys.delete(key);
+    if (!_P2PCommandRouter.isMediaSessionKey(sessionKey))
+      return;
+    void this.manager.close(sessionKey).catch((error) => this.reportError(error instanceof Error ? error : new Error(String(error))));
+  }
+  /**
+   * Drop the live source a media session was carrying, after that session closed on its own.
+   *
+   * The source holds the closed connection and never re-resolves it, so it can only answer its retained
+   * keyframe and then fail on its warm-up deadline. Its consumers get `stop`, and the next attach builds
+   * a fresh source — which, finding the station busy again, opens a fresh media session for it.
+   */
+  tearDownMediaSession(sessionKey) {
+    this.manager.remove(sessionKey);
+    for (const [key, owned] of this.liveSessionKeys) {
+      if (owned === sessionKey) {
+        this.liveSessionKeys.delete(key);
+        this.dropLiveSource(key);
+        return;
+      }
+    }
   }
   /**
    * Drop everything that was riding a station's session, and report the station closed.
@@ -19691,9 +20847,9 @@ var P2PCommandRouter = class _P2PCommandRouter {
           s.sendStringPayloadCommand(P2P_ENVELOPE.CONTROL_PAYLOAD, json, ch);
           return Promise.resolve();
         },
-        l2: async ({ session: s, channel: ch }) => {
+        l2: async ({ session: s, channel: ch, parentSn }) => {
           if (!await s.awaitLevel2Key(LEVEL2_GRACE_MS, "call")) {
-            throw new Error(`level-2 key not ready for ${sn} \u2014 cannot query`);
+            throw new StationKeyUnavailableError(parentSn);
           }
           s.sendRawLevel2(json, ch, P2P_ENVELOPE.CONTROL_PAYLOAD);
         }
@@ -19851,24 +21007,40 @@ var P2PCommandRouter = class _P2PCommandRouter {
     const parentSn = homeBaseAttached ? raw.parent_sn : dev.stationSn ?? sn;
     const session = this.manager.get(parentSn) ?? this.manager.get(sn) ?? (dev.stationSn ? this.manager.get(dev.stationSn) : void 0);
     if (!session) {
-      throw new Error(`no P2P session for ${sn} (known: ${this.manager.keys().join(", ") || "none"})`);
+      const stations = this.manager.keys().filter((k) => !_P2PCommandRouter.isMediaSessionKey(k));
+      throw new Error(`no P2P session for ${sn} (known: ${stations.join(", ") || "none"})`);
     }
     if (session.pathAnswering === false && !rebuilt) {
       (this.deps.logger ?? noopLogger).debug(`[p2p] ${parentSn} path stopped answering \u2014 rebuilding before use`);
       await this.manager.close(parentSn).catch((error) => this.reportError(error instanceof Error ? error : new Error(String(error))));
       return await this.resolveSession(sn, opts, true);
     }
-    this.manager.bumpCommand(parentSn);
+    this.manager.bumpCommand(parentSn, parentSn);
     const channel = typeof raw.device_channel === "number" ? raw.device_channel : 0;
-    const accountId = raw.member?.admin_user_id ?? this.deps.mega.auth?.userId ?? "";
+    const stationAdminId = raw.member?.admin_user_id;
+    const stationModel = this.recordFor(parentSn)?.model;
+    const accountId = stationAdminId ?? this.deps.mega.auth?.userId ?? "";
+    this.traceOnStation(session, {
+      phase: "station-resolved",
+      topology: homeBaseAttached ? "attached" : "own",
+      channel,
+      stationAdmin: typeof stationAdminId !== "string" ? "unstated" : stationAdminId === this.deps.mega.auth?.userId ? "self" : "other",
+      ...stationModel ? { stationModel } : {}
+    });
     const t0 = Date.now();
-    while (!session.isConnected && Date.now() - t0 < CONNECT_WAIT_MS) {
-      opts.signal?.throwIfAborted();
-      await sleep2(200);
+    let waitedMs = 0;
+    if (!session.isConnected) {
+      this.traceOnStation(session, { phase: "session-connect-wait", waitMs: P2P_STATION_WAITS.connect });
+      while (!session.isConnected && Date.now() - t0 < P2P_STATION_WAITS.connect) {
+        opts.signal?.throwIfAborted();
+        await sleep2(200);
+      }
+      waitedMs = Date.now() - t0;
+      this.traceOnStation(session, session.isConnected ? { phase: "session-connected", waitedMs } : { phase: "session-unreachable", waitedMs });
     }
     opts.signal?.throwIfAborted();
     if (!session.isConnected)
-      throw new Error(`P2P session for ${parentSn} did not connect`);
+      throw new StationUnreachableError(parentSn, waitedMs);
     if (opts.waitLevel2) {
       if (opts.waitLevel2 === "settle") {
         await abortable(session.awaitLevel2Key(LEVEL2_SETTLE_MS, "session"), opts.signal);
@@ -19882,7 +21054,7 @@ var P2PCommandRouter = class _P2PCommandRouter {
         ready = await abortable(session.awaitLevel2Key(LEVEL2_GRACE_MS, "call"), opts.signal);
       }
       if (!ready)
-        throw new Error(`level-2 key not ready for ${parentSn}`);
+        throw new StationKeyUnavailableError(parentSn);
     }
     return { session, parentSn, channel, accountId, homeBaseAttached };
   }
@@ -19955,13 +21127,22 @@ var P2PCommandRouter = class _P2PCommandRouter {
    * standalone camera never negotiates a level-2 key, so pinning this to level 2 makes the envelope
    * unreachable on exactly the devices that serve their own RTSP stream. Verified live: a standalone
    * camera accepts the level-1 form. With no `form` (default) it stays level-2 only.
+   *
+   * Both seals REPLAY the frame {@link DIRECT_CMD_SENDS}× at 200ms, as every other fire-and-forget
+   * control on this router does: these are unacknowledged datagrams, and a level-1 device is the one
+   * least able to afford a single dropped one — it has no reply, no readback here, and nothing that
+   * would tell a caller the write was lost rather than refused. The level-1 form reports delivery by
+   * throwing (`sendSetPayload` throws when the session has no address) rather than by returning a
+   * boolean, so the first pass carries the failure and the rest are repeats.
    */
   async sendSetPayloadEnvelope(sn, cmd, payload, channel, mValue3, resolved, form) {
     if (form === "auto") {
       await this.sendBySessionLevel(sn, {
-        l1: ({ session, accountId }) => {
-          session.sendSetPayload(cmd, payload, { accountId, channel });
-          return Promise.resolve();
+        l1: async ({ session, accountId }) => {
+          for (let i = 0; i < DIRECT_CMD_SENDS; i++) {
+            session.sendSetPayload(cmd, payload, { accountId, channel });
+            await sleep2(200);
+          }
         },
         // NB: do NOT forward sendBySessionLevel's resolved session here — it was resolved with
         // waitLevel2:false (enough to read topology), so on a HomeBase-attached device the level-2
@@ -21369,8 +22550,8 @@ function rsaEncryptPassword(password, publicKeyDecimal, exponentDecimal) {
     },
     format: "jwk"
   });
-  const md5Hex = createHash6("md5").update(password).digest("hex");
-  return publicEncrypt({ key: rsaKey, padding: constants2.RSA_PKCS1_PADDING }, Buffer.from(md5Hex)).toString("hex");
+  const md5Hex2 = createHash6("md5").update(password).digest("hex");
+  return publicEncrypt({ key: rsaKey, padding: constants2.RSA_PKCS1_PADDING }, Buffer.from(md5Hex2)).toString("hex");
 }
 var TuyaClient = class {
   signer;
@@ -22633,8 +23814,21 @@ var FileFcmStore = class {
   }
 };
 
+// dist/transport/media-failure.js
+var MEDIA_FAILURE_REASONS = [
+  "url-not-allowed",
+  "address-not-public",
+  "redirect-not-allowed",
+  "http-status",
+  "too-large",
+  "timeout",
+  "network",
+  "decode-failed"
+];
+
 // dist/transport/stored-image-cache.js
 var MAX_JPEG_BYTES = 10 * 1024 * 1024;
+var MAX_REMEMBERED_URLS = 64;
 var DIAGNOSTIC_INTERVAL_MS = 6e4;
 var StoredImageCache = class {
   downloader;
@@ -22651,7 +23845,13 @@ var StoredImageCache = class {
     this.clock = clock;
     this.isLifecycleError = isLifecycleError;
   }
-  /** Observe a normalized thumbnail URL and start acquisition eagerly. */
+  /**
+   * Observe a normalized thumbnail URL and start acquisition eagerly.
+   *
+   * A URL already inside this device's window of recent attempts is ignored, so one event arriving as
+   * several pushes downloads one thumbnail. The window is a `Set`, which iterates in insertion order,
+   * so the entry evicted once it is full is the oldest attempt.
+   */
   observe(deviceKey, url) {
     let state = this.devices.get(deviceKey);
     if (!state) {
@@ -22666,6 +23866,12 @@ var StoredImageCache = class {
     if (state.seenUrls.has(url))
       return;
     state.seenUrls.add(url);
+    while (state.seenUrls.size > MAX_REMEMBERED_URLS) {
+      const oldest = state.seenUrls.values().next();
+      if (oldest.done)
+        break;
+      state.seenUrls.delete(oldest.value);
+    }
     state.queued = {
       deviceKey,
       url,
@@ -22715,7 +23921,7 @@ var StoredImageCache = class {
       } else if (image === void 0) {
         state.lifecycleError = void 0;
         state.reason = "download-failed";
-        this.diagnose(state, candidate, "download-failed");
+        this.diagnose(state, candidate, "download-failed", error);
       } else if (!this.isValidJpeg(image)) {
         state.lifecycleError = void 0;
         state.reason = "invalid-image";
@@ -22731,7 +23937,7 @@ var StoredImageCache = class {
   isValidJpeg(image) {
     return Buffer.isBuffer(image) && image.length > 0 && image.length <= MAX_JPEG_BYTES && image.length >= 5 && image[0] === 255 && image[1] === 216 && image[2] === 255 && image[image.length - 2] === 255 && image[image.length - 1] === 217;
   }
-  diagnose(state, candidate, failure) {
+  diagnose(state, candidate, failure, error) {
     const now2 = this.clock();
     const last = state.loggedFailures.get(failure);
     if (last !== void 0 && now2 - last < DIAGNOSTIC_INTERVAL_MS)
@@ -22739,11 +23945,23 @@ var StoredImageCache = class {
     state.loggedFailures.set(failure, now2);
     this.logger.warn("[stored-snapshot-cache] candidate failed", {
       class: failure,
+      ...mediaFailureTag(error),
       observedAt: candidate.observedAt,
       retained: state.retained !== void 0
     });
   }
 };
+function mediaFailureTag(error) {
+  if (typeof error !== "object" || error === null)
+    return {};
+  const { mediaFailure, status } = error;
+  if (typeof mediaFailure !== "string")
+    return {};
+  const cause = MEDIA_FAILURE_REASONS.find((reason) => reason === mediaFailure);
+  if (!cause)
+    return {};
+  return Number.isInteger(status) && status >= 100 && status <= 599 ? { cause, status } : { cause };
+}
 
 // dist/client/device-registry.js
 function resolvedStationSn(raw, sn) {
@@ -23997,8 +25215,8 @@ var EufyMega = class extends EventEmitter9 {
    * @example
    * ```ts
    * const res = await eufy.login();
-   * if (res.status === "captcha") await eufy.solveCaptcha(await ask(res.image));
-   * else if (res.status === "2fa") await eufy.submitVerifyCode(await ask());
+   * if (res.status === "captcha") await eufy.solveCaptcha(await promptUser(res.image));
+   * else if (res.status === "2fa") await eufy.submitVerifyCode(await promptUser());
    * ```
    */
   async login(opts = {}) {
@@ -24152,9 +25370,9 @@ var EufyMega = class extends EventEmitter9 {
   /**
    * Combine explicit P2P media with the optional passive push-thumbnail provider.
    *
-   * The retained still also becomes the answer for a live still that could not be captured. A station
-   * serves one camera at a time and a live view outranks a tile, so a still asked for while a sibling is
-   * being watched is refused at the transport. Answering the retained bytes answers the read rather than
+   * The retained still also becomes the answer for a live still that could not be captured. One session
+   * serves one camera at a time and a live view outranks a tile — a still does not open a connection of its
+   * own — so a still asked for while a sibling is being watched is refused at the transport. Answering the retained bytes answers the read rather than
    * failing it, marked {@link MediaProvider.snapshotLive} `retained` so the caller knows they are not
    * current. With nothing retained the refusal stands.
    */
@@ -24323,7 +25541,7 @@ var EufyMega = class extends EventEmitter9 {
    * @example
    * ```ts
    * const dev = await eufy.getDevice(sn);
-   * if (dev.has("camera")) await dev.camera()?.snapshotStored();
+   * if (dev.has("camera")) await dev.camera?.()?.snapshotStored?.();
    * console.log(dev.getProperty("battery"));
    * ```
    */
@@ -24907,10 +26125,15 @@ var EufyMega = class extends EventEmitter9 {
       await sink.dispatch(cmd);
   }
   /**
-   * Stations with a live P2P session. P2P is auto-managed: wired stations are warmed at login, battery
+   * The open P2P sessions, by key. P2P is auto-managed: wired stations are warmed at login, battery
    * stations open on demand (command / stream, or an opted-in event pre-warm) and idle-detach — so this
-   * map grows and shrinks over time. `p2pConnect(stationSn)` / `p2pClose(stationSn)` events track the
-   * changes.
+   * map grows and shrinks over time.
+   *
+   * A station's own session is keyed by its serial, and `p2pConnect(stationSn)` / `p2pClose(stationSn)`
+   * track those. A station serving more than one camera at once also holds a session per extra camera,
+   * keyed `<stationSn>#live:<channel>` — these carry media alone and raise no connection events, because
+   * a station announces its state to every client that connects and reporting each copy would double
+   * every event the station's own session already delivers.
    */
   getP2pSessions() {
     return this.p2p.getSessions();
@@ -25283,6 +26506,971 @@ var EufyMega = class extends EventEmitter9 {
   }
 };
 
+// dist/transport/http/solix-constants.js
+var SOLIX_APP_NAME = "anker_power";
+var SOLIX_ESTIMATE_HOST = "uniapp-api-pr.anker.com";
+var SOLIX_DEFAULT_API_HOST = "ankerpower-api-eu.anker.com";
+var SOLIX_ENDPOINTS = {
+  estimateDomain: "/passport/estimate_domain",
+  keyExchange: "/openapi/oauth/key/exchange",
+  login: "/passport/login",
+  /** Bound devices for the account (flat list). */
+  getRelateAndBindDevices: "/power_service/v1/app/get_relate_and_bind_devices",
+  /** Sites (systems) the account owns; devices are grouped under a site. */
+  getSiteList: "/power_service/v1/site/get_site_list",
+  /** Per-user AWS-IoT MQTT credentials (cert/key/endpoint/thing) for the real-time device plane. */
+  getUserMqttInfo: "/v1/openapi/devicemanage/get_user_mqtt_info",
+  /** GET: the pairable-product catalog (categories → products), for labelling model codes. */
+  productCategories: "/power_service/v1/product_categories",
+  /** POST (encrypted+signed): write device attributes, e.g. `{ambient_light_switch: 0|1}`. */
+  setDeviceAttrs: "/power_service/v1/app/device/set_device_attrs",
+  /** POST (plain authed): read device attributes, e.g. the display `screen_off_time` (seconds). */
+  getDeviceAttrs: "/power_service/v1/app/device/get_device_attrs",
+  /** POST (plain authed): the battery discharge-cutoff (minimum-SOC) preset options. */
+  getPowerCutoff: "/power_service/v1/app/compatible/get_power_cutoff",
+  /** POST (encrypted+signed): select the discharge-cutoff preset by `cutoff_data_id`. */
+  setPowerCutoff: "/power_service/v1/app/compatible/set_power_cutoff",
+  /**
+   * POST (plain authed): the site "scene" snapshot — the same clean Solarbank/grid telemetry the app
+   * reads on load/refresh. Used as a low-rate BACKSTOP for the fields the realtime `ff09` push doesn't
+   * carry reliably (notably `bat_temperature`), NOT as the realtime source (that is the MQTT push).
+   */
+  getSiteScene: "/power_service/v2/site/platform_get_site_scene",
+  /**
+   * POST (plain authed): read a site "device param" block by `param_type`. Body is
+   * `{ site_id, param_type, cmd: 246 }`; the response's `data.param_data` is a JSON STRING the caller
+   * parses. The Solarbank's SOC-limit settings live under `param_type "27"` (charge/discharge limits,
+   * backup reserve) — verified live on an AE103 (`"18"` returns empty for this device).
+   */
+  getSiteDeviceParam: "/power_service/v1/site/get_site_device_param",
+  /**
+   * POST (encrypted+signed): write a site "device param" block. Body is
+   * `{ site_id, cmd: 246, param_type, param_data: <JSON string> }`. Used for the SOC-limit write
+   * (`param_type "27"`, `param_data` = the SocSettingParam map) — see {@link SolixClient.setSafetySocParams}.
+   */
+  setSiteDeviceParam: "/power_service/v1/site/set_site_device_param"
+};
+
+// dist/transport/http/solix-client.js
+function solixSessionFresh(s) {
+  return !!s?.authToken && tokenNotExpired(s.tokenExpiresAt);
+}
+var SOLIX_TOKEN_KICKED_CODE = 26084;
+var uuidFromHex = (hex) => `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
+var SolixClient = class _SolixClient {
+  email;
+  password;
+  country;
+  appVersion;
+  doFetch;
+  store;
+  openudid;
+  apiHost;
+  session_;
+  /** Carried between {@link login} and {@link submitVerifyCode} while a 2FA code is outstanding. */
+  pending2fa;
+  /**
+   * Resolve the device id (explicit → stored → deterministic from the email, so it is stable and does
+   * not re-trigger 2FA) and adopt a stored session that has not expired, so a warm start skips the
+   * handshake. An explicit `opts.apiHost` outranks a stored session's host in both cases: it is an
+   * override that also skips domain-estimate, and every read goes through `this.apiHost`.
+   */
+  constructor(opts) {
+    this.email = opts.email;
+    this.password = opts.password;
+    this.country = (opts.countryCode ?? "US").toUpperCase();
+    this.appVersion = opts.appVersion ?? "3.23.0";
+    this.doFetch = opts.fetchImpl ?? fetch;
+    this.apiHost = opts.apiHost ?? SOLIX_DEFAULT_API_HOST;
+    this.store = opts.store;
+    const saved = this.store?.load();
+    this.openudid = opts.openudid ?? saved?.openudid ?? uuidFromHex(md5Hex(`anker-solix:${opts.email}`));
+    if (saved?.session && solixSessionFresh(saved.session)) {
+      this.session_ = saved.session;
+      this.apiHost = opts.apiHost ?? saved.session.apiHost;
+    }
+  }
+  /** Persist the current device id (+ session, if any) when a store is configured. */
+  persist() {
+    this.store?.save({ openudid: this.openudid, session: this.session_ });
+  }
+  /** The authenticated session, once {@link login} has resolved to `ok`. */
+  get session() {
+    return this.session_;
+  }
+  /**
+   * Headers for the login/key-exchange path, which carry the device id. Authenticated resource reads
+   * must NOT send `openudid` — the gateway rejects a token-bearing read that also carries a device id
+   * (`401 token error`) — so those use {@link baseHeaders} directly.
+   */
+  authHeaders(extra = {}) {
+    return this.baseHeaders({ openudid: this.openudid, "x-terminal-id": this.openudid, ...extra });
+  }
+  /** Base headers common to every Solix request. */
+  baseHeaders(extra = {}) {
+    return {
+      "content-type": "application/json",
+      "app-name": SOLIX_APP_NAME,
+      "model-type": "PHONE",
+      "os-type": "android",
+      "os-version": "36",
+      "app-version": this.appVersion,
+      country: this.country,
+      timezone: "GMT+00:00",
+      language: "en",
+      "user-agent": "ktor-client",
+      accept: "application/json",
+      ...extra
+    };
+  }
+  /** One request path for every Solix call (GET or POST) — always parses through the non-JSON guard. */
+  async send(method2, host, path, headers, body) {
+    const res = await this.doFetch(`https://${host}${path}`, {
+      method: method2,
+      headers,
+      body,
+      signal: AbortSignal.timeout(2e4)
+    });
+    const text2 = await res.text();
+    try {
+      return JSON.parse(text2);
+    } catch {
+      throw new Error(`Solix ${path} \u2192 HTTP ${res.status}, non-JSON: ${text2.slice(0, 120)}`);
+    }
+  }
+  /** POST helper for the login/key-exchange path (which builds its own bespoke headers per request). */
+  post(host, path, body, headers) {
+    return this.send("POST", host, path, headers, body);
+  }
+  /** Resolve the regional API host via domain-estimate (best-effort; keeps the default on failure). */
+  async estimateHost() {
+    try {
+      const env = await this.post(SOLIX_ESTIMATE_HOST, SOLIX_ENDPOINTS.estimateDomain, JSON.stringify({ ab: this.country, mode: 1 }), this.baseHeaders());
+      const domain = env.data?.domain;
+      if (domain)
+        this.apiHost = domain;
+    } catch {
+    }
+  }
+  /** Do the localKey-bootstrapped ECDH key exchange and return the negotiated session key. */
+  async keyExchange() {
+    const prep = prepareKeyExchange(SOLIX_LOCAL_KEY_HEX);
+    const env = await this.post(this.apiHost, SOLIX_ENDPOINTS.keyExchange, JSON.stringify({ client_public_key: prep.encryptedClientPublicKey }), this.authHeaders(prep.headers));
+    const spk = env.data?.server_public_key;
+    if (env.code !== 0 || !spk)
+      throw new Error(`Solix key/exchange failed (${env.code}): ${env.msg}`);
+    return finishKeyExchange(prep, spk);
+  }
+  /** Build the encrypted, signed `/passport/login` request body + headers for the negotiated key. */
+  async postLogin(kx, verifyCode, limitedToken) {
+    const { clientPublicKeyHex, encryptedPassword } = encryptLoginPassword(this.password);
+    const bodyObj = {
+      email: this.email,
+      password: encryptedPassword,
+      ab: this.country,
+      client_secret_info: { public_key: clientPublicKeyHex },
+      answer: "",
+      captcha_id: "",
+      verify_code: verifyCode ?? "",
+      login_id: ""
+    };
+    const encBody = encryptBody(JSON.stringify(bodyObj), kx.shareKey);
+    const ts = nowSec();
+    const once = genId();
+    return this.post(this.apiHost, SOLIX_ENDPOINTS.login, encBody, this.authHeaders({
+      "x-encryption-info": "algo_ecdh",
+      "x-key-ident": kx.keyIdent,
+      "x-request-ts": ts,
+      "x-request-once": once,
+      "x-signature": signRequest(kx.shareKey, ts, once, encBody),
+      ...limitedToken ? { "x-auth-token": limitedToken } : {}
+    }));
+  }
+  /**
+   * Turn a decrypted `/passport/login` payload into an `ok`/`2fa` result, establishing the session on
+   * `ok`. The passport marks a pending 2FA with a non-empty `fa_info.info`, and empties it once the code
+   * has been satisfied.
+   *
+   * `gtoken` is hashed from `ap_cloud_user_id` where the reply carries one, `user_id` otherwise. Whether
+   * this gateway recomputes the header from `user_id` specifically — as the mega gateway does, rejecting a
+   * disagreement with `"gtoken not equal userid error"` — is unverified here: no Solix response has been
+   * observed refusing the header, which is consistent with the two ids agreeing on the accounts seen.
+   */
+  classifyLogin(data, isVerify) {
+    const userId = data.ap_cloud_user_id ?? data.user_id;
+    const authToken = data.auth_token;
+    if (!userId || !authToken)
+      throw new Error(`Solix login returned no session: ${JSON.stringify(data).slice(0, 160)}`);
+    const faInfo = data.fa_info ?? {};
+    if (!isVerify && faInfo.info) {
+      this.pending2fa = { limitedToken: authToken, userId, geoKey: data.geo_key };
+      return { status: "2fa", method: "code sent by the passport" };
+    }
+    this.pending2fa = void 0;
+    this.session_ = {
+      authToken,
+      userId,
+      gtoken: gtoken(userId),
+      apiHost: this.apiHost,
+      tokenExpiresAt: Number(data.token_expires_at ?? 0) || 0
+    };
+    this.persist();
+    return { status: "ok", session: this.session_ };
+  }
+  /** Decrypt a login envelope's `data` (base64 `IV(16)||AES-128-CBC`, keyed by the share key). */
+  decryptLogin(env, kx) {
+    if (typeof env.data !== "string")
+      throw new Error(`Solix login (${env.code}): ${env.msg}`);
+    return JSON.parse(decryptBody(env.data, kx.shareKey).toString("utf-8"));
+  }
+  /**
+   * Authenticate with the account credentials. Resolves to `ok` with a {@link SolixSession}, or `2fa`
+   * when the passport sent a code — then call {@link submitVerifyCode}. A session that is already fresh
+   * (adopted from a store) is answered without a handshake.
+   */
+  async login() {
+    if (solixSessionFresh(this.session_)) {
+      return { status: "ok", session: this.session_ };
+    }
+    await this.estimateHost();
+    const kx = await this.keyExchange();
+    const env = await this.postLogin(kx);
+    this.assertLoginAccepted(env);
+    return this.classifyLogin(this.decryptLogin(env, kx), false);
+  }
+  /**
+   * On a rejected `/passport/login` (non-zero code, so `data` is an error envelope not the encrypted
+   * payload), throw a diagnostic that names WHY the passport refused — the throttle (`26161`, "too
+   * frequent") vs a challenge it wants the client to satisfy. The passport marks a required captcha with
+   * a `captcha_id`/`item`; our headless client cannot answer one, so surfacing it distinguishes "wait
+   * out the rate-limit" from "a captcha is required — clear it in the app". No secrets are logged, only
+   * the code, message, and which challenge fields are present.
+   */
+  assertLoginAccepted(env) {
+    if (env.code === 0)
+      return;
+    const d = env.data ?? {};
+    const hints = [];
+    if (typeof d === "object" && d) {
+      if ("captcha_id" in d && d.captcha_id)
+        hints.push("captcha_id present (captcha required)");
+      if ("item" in d && d.item)
+        hints.push(`item=${String(d.item).slice(0, 40)}`);
+      const keys = Object.keys(d);
+      if (keys.length && hints.length === 0)
+        hints.push(`data keys: ${keys.join(",")}`);
+    }
+    const detail = hints.length ? ` [${hints.join("; ")}]` : "";
+    throw new Error(`Solix login (${env.code}): ${env.msg}${detail}`);
+  }
+  /** Complete a `2fa` login with the code the passport sent. */
+  async submitVerifyCode(code) {
+    if (!this.pending2fa)
+      throw new Error("no 2FA login is pending");
+    const kx = await this.keyExchange();
+    const env = await this.postLogin(kx, code, this.pending2fa.limitedToken);
+    return this.classifyLogin(this.decryptLogin(env, kx), true);
+  }
+  /**
+   * One authenticated PLAIN read for both GET and POST endpoints (no per-request encryption; carries
+   * the auth token + `gtoken` only). Routes through {@link send} so every read keeps the non-JSON guard.
+   *
+   * Self-heals a **displaced session**: Anker allows ~one session per account, so another login (the app,
+   * or a second client) invalidates this token and reads then fail with {@link SOLIX_TOKEN_KICKED_CODE}
+   * ("token does not exist because it was kicked out"). On that code this re-logs in once and retries, so
+   * a running client recovers on its own instead of failing every read until its session store is cleared.
+   */
+  async authed(method2, path, body, reauthed = false) {
+    if (!this.session_)
+      throw new Error("not authenticated \u2014 call login() first");
+    const env = await this.send(method2, this.apiHost, path, this.baseHeaders({ gtoken: this.session_.gtoken, "x-auth-token": this.session_.authToken }), body ? JSON.stringify(body) : void 0);
+    if (env.code === 0)
+      return env.data ?? null;
+    if (env.code === SOLIX_TOKEN_KICKED_CODE && !reauthed) {
+      this.session_ = void 0;
+      const r = await this.login();
+      if (r.status !== "ok")
+        throw new Error(`Solix ${path}: session was kicked and re-login did not complete (${r.status})`);
+      return this.authed(method2, path, body, true);
+    }
+    throw new Error(`Solix ${path} failed (${env.code}): ${env.msg}`);
+  }
+  /**
+   * The account's bound Solix devices (flat list; may be empty when devices live under sites). The
+   * gateway's JSON is asserted to {@link SolixDeviceRecord} here, at the one trust boundary — every field
+   * beyond `device_sn`/`product_code` is optional on the record, so a caller reads them defensively.
+   */
+  async getDevices() {
+    const data = await this.authed("POST", SOLIX_ENDPOINTS.getRelateAndBindDevices, {});
+    return Array.isArray(data) ? data : data?.data ?? [];
+  }
+  /**
+   * The account's sites (systems); devices are grouped under a site. Each record carries its
+   * `site_device_list` (the member devices), which {@link discoverSolixSites} resolves into a
+   * capability-driven `SolixSite`. Asserted to {@link SolixSiteRecord} at this trust boundary — and
+   * `site_id` (the one field the model layer keys a `SolixSite` on) is validated here, so a record the
+   * cloud returns without a usable id is dropped rather than surfacing a `SolixSite` with `id ===
+   * undefined`; every other field is optional and read defensively.
+   */
+  async getSites() {
+    const data = await this.authed("POST", SOLIX_ENDPOINTS.getSiteList, {});
+    const list = data?.site_list ?? [];
+    return list.filter((s) => typeof s?.site_id === "string" && s.site_id.length > 0);
+  }
+  /** Per-user AWS-IoT MQTT credentials (cert/key/endpoint/thing) for the real-time device plane. */
+  async getUserMqttInfo() {
+    return this.authed("POST", SOLIX_ENDPOINTS.getUserMqttInfo, {});
+  }
+  /**
+   * Read a site's "scene" snapshot — the app's dashboard read for a system, a plain authed read. Its
+   * battery detail (`solarbank_info.solarbank_list[]`) carries clean, correctly-named fields including
+   * `bat_temperature`, which the realtime `ff09` MQTT push does NOT reliably carry (the fast frame's BMS
+   * blob is empty, so the decoder withholds temperature). This is therefore a low-rate BACKSTOP for those
+   * gap fields — NOT the realtime source: live power/SOC still come from the MQTT push (which is what the
+   * app itself refreshes from every ~5 s; there is no clean-JSON scene PUSH). Verified live against the
+   * `ff09` floats — the two agree to the watt at the same instant.
+   */
+  async getSiteScene(siteId) {
+    return this.authed("POST", SOLIX_ENDPOINTS.getSiteScene, { site_id: siteId });
+  }
+  /**
+   * The pairable-product catalog (categories → products). This is Anker's product registry, not the
+   * account's devices — fetch it to label a discovered device's model code with a marketing name and
+   * category. Pair with {@link buildModelIndex}. It is a live endpoint, so it stays current without a
+   * baked-in table.
+   */
+  async getProductCatalog() {
+    return await this.authed("GET", SOLIX_ENDPOINTS.productCategories) ?? [];
+  }
+  /**
+   * Write device attributes — a CONTROL write, e.g. the Solarbank ambient light
+   * `{ ambient_light_switch: 0 | 1 }` (0 = on, 1 = off). Unlike the plain authenticated reads, a write
+   * must be **encrypted + signed** with a freshly negotiated `algo_ecdh` key: the gateway accepts an
+   * unsigned write with `code 0` but the device never applies it. The token-bearing request also must
+   * NOT carry the device id (`openudid`), or the gateway answers `401 token error`. Both verified live
+   * on an AE103 (the LED-enable bit in the `ba` telemetry flips exactly as commanded).
+   */
+  async setDeviceAttrs(deviceSn, attributes) {
+    await this.encryptedWrite(SOLIX_ENDPOINTS.setDeviceAttrs, "set_device_attrs", {
+      device_sn: deviceSn,
+      attributes
+    });
+  }
+  /**
+   * A CONTROL write: `algo_ecdh`-encrypted + signed, token-bearing but WITHOUT `openudid`. Every device
+   * control the account performs (set_device_attrs, set_power_cutoff, …) goes through this — the gateway
+   * accepts an unsigned/plain write with `code 0` but the device never applies it, and adding `openudid`
+   * to the token-bearing request returns `401 token error`. Both verified live on an AE103.
+   */
+  async encryptedWrite(path, label, payload) {
+    if (!this.session_)
+      throw new Error("not authenticated \u2014 call login() first");
+    const kx = await this.keyExchange();
+    const encBody = encryptBody(JSON.stringify(payload), kx.shareKey);
+    const ts = nowSec();
+    const once = genId();
+    const env = await this.post(this.apiHost, path, encBody, this.baseHeaders({
+      "x-encryption-info": "algo_ecdh",
+      "x-key-ident": kx.keyIdent,
+      "x-request-ts": ts,
+      "x-request-once": once,
+      "x-signature": signRequest(kx.shareKey, ts, once, encBody),
+      "x-auth-token": this.session_.authToken,
+      gtoken: this.session_.gtoken
+    }));
+    if (env.code !== 0)
+      throw new Error(`Solix ${label} failed (${env.code}): ${env.msg}`);
+  }
+  /** Turn the Solarbank's ambient LED on/off — a confirmed `set_device_attrs` write. */
+  async setAmbientLight(deviceSn, on) {
+    await this.setDeviceAttrs(deviceSn, { ambient_light_switch: on ? 0 : 1 });
+  }
+  /**
+   * Read device attributes — a plain authenticated read (unlike the encrypted write). `attributes`
+   * names the keys to fetch (e.g. `["screen_off_time"]`); an empty list asks for the device's default
+   * set. Returns the gateway's attribute map as-is (values are device-typed — numbers, strings). Used
+   * to reflect a control's live state, e.g. the display/light off-timeout.
+   */
+  async getDeviceAttrs(deviceSn, attributes = []) {
+    const data = await this.authed("POST", SOLIX_ENDPOINTS.getDeviceAttrs, { device_sn: deviceSn, attributes });
+    if (data && typeof data === "object" && "attributes" in data && data.attributes) {
+      return data.attributes;
+    }
+    return data ?? {};
+  }
+  /**
+   * Set the Solarbank display's screen-off timeout, in SECONDS (`screen_off_time`). The app's picker
+   * offers 10/20/30 s and 1/5/30 min; the LCD backlight — and with it the ambient LED that the screen
+   * gates — turns off after this idle period. This is the raw-seconds write; the caller maps its own UI
+   * options to seconds. The "Never" (always-on) sentinel is device-defined and NOT assumed here — pass
+   * the exact integer read back from {@link getDeviceAttrs} while the device is in that mode.
+   */
+  async setScreenOffTime(deviceSn, seconds) {
+    await this.setDeviceAttrs(deviceSn, { screen_off_time: seconds });
+  }
+  /**
+   * Read the Solarbank's battery discharge-cutoff (minimum-SOC) options — a plain authed read.
+   * The gateway returns a preset list (`power_cutoff_data`): each entry is a selectable minimum
+   * state-of-charge `output_cutoff_data` (percent) with its `id` and `is_selected` flag. The caller
+   * presents these options and writes the chosen `id` back via {@link setPowerCutoff} — the values and
+   * ids come from the device, never assumed. `siteId` is optional (the device knows its own cutoff).
+   */
+  async getPowerCutoff(deviceSn, siteId = "") {
+    const data = await this.authed("POST", SOLIX_ENDPOINTS.getPowerCutoff, { site_id: siteId, device_sn: deviceSn });
+    return data?.power_cutoff_data ?? [];
+  }
+  /**
+   * Select the Solarbank's battery discharge-cutoff (minimum SOC) by option id — a control write.
+   * `cutoffDataId` MUST be an `id` returned by {@link getPowerCutoff} for this device (the preset the
+   * user picked), never a raw percentage; the gateway maps the id to its cutoff percent.
+   */
+  async setPowerCutoff(deviceSn, cutoffDataId) {
+    await this.encryptedWrite(SOLIX_ENDPOINTS.setPowerCutoff, "set_power_cutoff", {
+      device_sn: deviceSn,
+      cutoff_data_id: cutoffDataId
+    });
+  }
+  /** The `param_type` under which the Solarbank's SOC-limit block lives (verified live on an AE103). */
+  static SOC_PARAM_TYPE = "27";
+  /** `cmd` value that scopes the `site/*_site_device_param` family (from the app's request builder). */
+  static SITE_DEVICE_PARAM_CMD = 246;
+  /**
+   * Read one of a site's "device param" blocks by `param_type` — a plain authenticated read whose
+   * `data.param_data` is itself a JSON STRING (the vendor double-encodes it). Returns the parsed inner
+   * object, or `{}` when the block is empty (the gateway answers `code 0` with an empty `param_data`
+   * for a `param_type` that does not apply to the site's hardware). The caller owns the inner shape.
+   */
+  async getSiteDeviceParam(siteId, paramType) {
+    const data = await this.authed("POST", SOLIX_ENDPOINTS.getSiteDeviceParam, {
+      site_id: siteId,
+      param_type: paramType,
+      cmd: _SolixClient.SITE_DEVICE_PARAM_CMD
+    });
+    const raw = data?.param_data;
+    if (!raw)
+      return {};
+    try {
+      return JSON.parse(raw);
+    } catch {
+      return {};
+    }
+  }
+  /**
+   * Read the Solarbank's battery SOC-limit settings (`param_type "27"`) — a plain authenticated read.
+   * Returns `undefined` when the site carries no SOC block (e.g. non-Solarbank hardware). The realtime
+   * `dischargeLowerLimit` also arrives on the MQTT `b5` telemetry blob; this is the authoritative,
+   * app-synced source (and the only source for `chargeUpperLimit` / `backupReserve`). Verified live
+   * against a known AE103 setting (discharge 20 / charge 80).
+   */
+  async getSafetySocParams(siteId) {
+    const p = await this.getSiteDeviceParam(siteId, _SolixClient.SOC_PARAM_TYPE);
+    if (typeof p.charge_upper_limit !== "number" || typeof p.discharge_lower_limit !== "number") {
+      return void 0;
+    }
+    return {
+      chargeUpperLimit: p.charge_upper_limit,
+      dischargeLowerLimit: p.discharge_lower_limit,
+      backupReserve: typeof p.backup_reserve === "number" ? p.backup_reserve : 0,
+      backupReserveSwitch: typeof p.backup_reserve_switch === "number" ? p.backup_reserve_switch : 0,
+      socCalibrationEnable: typeof p.soc_calibration_enable === "number" ? p.soc_calibration_enable : 0
+    };
+  }
+  /**
+   * Write the Solarbank's battery SOC limits — an `algo_ecdh`-encrypted + signed control write. This is
+   * **read-modify-write**: it first reads the current `param_type "27"` block and overlays only the
+   * fields the caller supplies, so changing the discharge limit alone never clobbers the charge limit,
+   * backup reserve, or calibration toggle. `changes` values are whole-percent integers. The full block
+   * (all five keys) is sent, matching the app's `SocSettingParam.toJson`. Throws if the site has no SOC
+   * block to modify. Returns the merged parameters that were written (for an immediate optimistic echo).
+   */
+  async setSafetySocParams(siteId, changes) {
+    const current = await this.getSafetySocParams(siteId);
+    if (!current)
+      throw new Error(`Solix set SOC params: site has no param_type 27 block`);
+    const merged = { ...current, ...changes };
+    await this.encryptedWrite(SOLIX_ENDPOINTS.setSiteDeviceParam, "set_site_device_param", {
+      site_id: siteId,
+      cmd: _SolixClient.SITE_DEVICE_PARAM_CMD,
+      param_type: _SolixClient.SOC_PARAM_TYPE,
+      param_data: JSON.stringify({
+        charge_upper_limit: merged.chargeUpperLimit,
+        discharge_lower_limit: merged.dischargeLowerLimit,
+        backup_reserve_switch: merged.backupReserveSwitch,
+        backup_reserve: merged.backupReserve,
+        soc_calibration_enable: merged.socCalibrationEnable
+      })
+    });
+    return merged;
+  }
+};
+
+// dist/transport/mqtt/solix-mqtt.js
+import { EventEmitter as EventEmitter10 } from "node:events";
+var SOLIX_METER_FIELD_NAMES = {
+  168: "meterPowerL1",
+  169: "meterPowerL2",
+  170: "meterPowerL3",
+  171: "meterPowerTotal",
+  172: "meterVoltageL1",
+  173: "meterVoltageL2",
+  174: "meterVoltageL3",
+  175: "meterCurrentL1",
+  176: "meterCurrentL2",
+  177: "meterCurrentL3",
+  179: "meterImportEnergy",
+  180: "meterExportEnergy"
+};
+var SOLIX_METER_PRODUCT_PREFIXES = ["AE1X0"];
+var SOLIX_SOLARBANK_PRODUCT_PREFIX = "AE10";
+var SOLIX_SOLARBANK_FIELD_NAMES = {
+  171: "photovoltaicPower",
+  // total PV input across the strings
+  172: "batteryPower",
+  188: "chargePower",
+  173: "dischargePower",
+  174: "acPlugPower",
+  175: "socketPower",
+  // the unit's own on-board AC socket (an appliance plugged into the Solarbank)
+  196: "gridInputPower",
+  197: "homeLoadPower",
+  198: "pv1Power",
+  // the four PV-string inputs (0 when a string is unused / dark)
+  199: "pv2Power",
+  200: "pv3Power",
+  201: "pv4Power"
+};
+var SOLIX_STATE_FIELD_NAMES = {
+  169: "mode",
+  // current operating (EMS) mode (1 custom, 2 self-consumption, 4 rapid charge, 7 smart, 8 dynamic tariff)
+  170: "maxLoad"
+  // configured max home load (W) — matches get_site_device_param max_load
+  // NOTE `0xab` is grid-in/out-related power but its exact meaning is not yet pinned, so it stays raw
+  // `state_ab` (a diagnostic a consumer can watch) rather than being asserted under a guessed name.
+};
+function solixStateReadings(frame) {
+  const out = {};
+  for (const [tag2, value] of frame.fields) {
+    if (tag2 < 165 || !value || value.length < 2)
+      continue;
+    const type = value[0];
+    const pl = value.subarray(1);
+    let num2;
+    if (type === 5 && pl.length >= 4)
+      num2 = pl.readFloatLE(0);
+    else if (type === 2 && pl.length >= 2)
+      num2 = pl.readUInt16LE(0);
+    else if (type === 1 && pl.length >= 1)
+      num2 = pl[0];
+    else if (type === 3 && pl.length >= 2)
+      num2 = pl[1];
+    if (num2 === void 0)
+      continue;
+    out[`state_${tag2.toString(16)}`] = num2;
+    const name = SOLIX_STATE_FIELD_NAMES[tag2];
+    if (name)
+      out[name] = num2;
+  }
+  return out;
+}
+function readSolixChannel(value) {
+  if (!value || value.length < 1)
+    return void 0;
+  const raw = value.subarray(1);
+  const ch = { type: value[0], raw };
+  if (raw.length === 4) {
+    ch.float = raw.readFloatLE(0);
+    ch.uint = raw.readUInt32LE(0);
+  }
+  return ch;
+}
+function decodeSolixParamFrame(buf) {
+  if (buf.length < 10 || buf[0] !== 255 || buf[1] !== 9)
+    return null;
+  const declaredLen = buf.readUInt16LE(2);
+  if (declaredLen < 5 || declaredLen > buf.length)
+    return null;
+  let xor = 0;
+  for (let i = 0; i < declaredLen; i++)
+    xor ^= buf[i];
+  if (xor !== 0)
+    return null;
+  const end = declaredLen - 1;
+  const start = buf.indexOf(161, 4);
+  if (start < 0 || start >= end)
+    return { fields: /* @__PURE__ */ new Map() };
+  const fields = walkFf09Tlv(buf, start, end);
+  let deviceSn;
+  const a2 = fields.get(162);
+  if (a2 && a2.length > 1)
+    deviceSn = a2.subarray(1).toString("latin1").replace(/\0+$/, "") || void 0;
+  return { deviceSn, fields };
+}
+function solixReadings(frame, productCode) {
+  const out = {};
+  const isMeter = SOLIX_METER_PRODUCT_PREFIXES.some((p) => productCode.startsWith(p));
+  const isSolarbank = productCode.startsWith(SOLIX_SOLARBANK_PRODUCT_PREFIX);
+  const floatNames = isMeter ? SOLIX_METER_FIELD_NAMES : isSolarbank ? SOLIX_SOLARBANK_FIELD_NAMES : void 0;
+  for (const [tag2, value] of frame.fields) {
+    if (tag2 < 166)
+      continue;
+    const ch = readSolixChannel(value);
+    if (ch?.type !== 5 || ch.float === void 0)
+      continue;
+    out[`channel_${tag2.toString(16)}`] = ch.float;
+    const name = floatNames?.[tag2];
+    if (name)
+      out[name] = ch.float;
+  }
+  if (isSolarbank)
+    addSolarbankScalars(frame, out);
+  return out;
+}
+function addSolarbankScalars(frame, out) {
+  const a3 = frame.fields.get(163);
+  const soc = a3 && a3.length >= 2 ? a3[1] : void 0;
+  if (soc !== void 0) {
+    out.batterySoc = soc;
+    const body = frame.fields.get(164)?.subarray(1);
+    if (body && body.length >= 8 && body[body.length - 6] === soc) {
+      out.batteryTemperature = body[body.length - 8];
+    }
+  }
+  const b5 = frame.fields.get(181);
+  if (b5 && b5[0] === 4 && b5.length === 4) {
+    out.dischargeLimit = b5[1];
+    out.chargeLimit = b5[3];
+  }
+}
+var SolixMqtt = class extends EventEmitter10 {
+  transport;
+  appName;
+  userId;
+  appClientId;
+  armIntervalMs;
+  logger;
+  siteId;
+  watched = /* @__PURE__ */ new Map();
+  seq = 0;
+  armTimer;
+  /**
+   * Bind to one account's MQTT plane. The envelope `client_id` takes the app's shape
+   * (`android-{app}-{uid}-{mqttUuid}-{ts}`); its `mqttUuid` half must be stable across restarts, or every
+   * restart presents itself to the broker as a new client, so it defaults deterministically from the user
+   * id (see {@link SolixMqttOptions.mqttUuid}) rather than a fresh random per instance.
+   */
+  constructor(opts) {
+    super();
+    this.appName = opts.mqttInfo.app_name ?? "anker_power";
+    this.userId = opts.userId ?? opts.mqttInfo.user_id;
+    this.armIntervalMs = opts.armIntervalMs ?? 25e3;
+    this.siteId = opts.siteId;
+    this.logger = opts.logger;
+    const uid = this.userId ?? "anonymous";
+    this.appClientId = opts.appClientId ?? buildAppShapedClientId({
+      appName: this.appName,
+      uid,
+      mqttUuid: opts.mqttUuid ?? mqttUuidFrom(`anker-solix-mqtt:${uid}`)
+    });
+    this.transport = new SecureMqtt({
+      credentials: opts.mqttInfo,
+      clientId: opts.clientId ?? opts.mqttInfo.thing_name,
+      reconnectPeriod: 5e3,
+      logger: opts.logger
+    });
+    this.transport.on("error", (e) => this.emit("error", e));
+    this.transport.on("message", (msg) => this.onMessage(msg));
+  }
+  /**
+   * Connect, subscribe to the device's telemetry (+ command-reply) topics, ARM realtime reporting, and
+   * start the re-arm/heartbeat timer so telemetry keeps flowing without the app. Idempotent per device.
+   *
+   * Subscribes to `param_info` (+ the device/account command-reply channels) AND the device's `…/req`
+   * channel. `…/req` is the app→device request side — the broker copies the APP's own publishes there to
+   * any co-subscriber, so watching it lets us read a control the app changed that the telemetry does NOT
+   * reflect: the Solarbank's ambient light and display timeout ride an `…/req` cmd-17 (`0x68`) command
+   * (tags `a4`/`a5`), and the `param_info` `ba` bit only tracks OUR `set_device_attrs` write, never the
+   * app's separate command path. `onMessage` filters these — our own arming/echoes carry no
+   * `a4`/`a5` — and turns an app command into a `reading` with the app-set state. A `…/req` grant denial
+   * is non-fatal (only `param_info` is required); we just won't see app-side changes.
+   *
+   * Throws when `param_info` was not granted. A scope-denied filter comes back as SUBACK_FAILURE rather
+   * than an error (see `SecureMqtt.subscribe`), so an unusable subscription otherwise looks like
+   * success: the call would resolve and arm on every interval while no reading ever arrives.
+   *
+   * The re-arm timer is unreffed, so a caller that watches and returns can still exit.
+   */
+  async watch(device) {
+    await this.transport.connect();
+    const topics = solixDeviceTopics(this.appName, device.product_code, device.device_sn);
+    const granted = await this.transport.subscribe([
+      topics.paramInfo,
+      topics.stateInfo,
+      topics.cmdRes,
+      topics.req,
+      ...this.userId ? [solixUserTopics(this.appName, this.userId).cmdRes] : []
+    ]);
+    if (!granted.includes(topics.paramInfo)) {
+      const scope = this.appName;
+      throw new Error(`watch ${device.device_sn}: telemetry topic "${topics.paramInfo}" denied on credential scope "${scope}" \u2014 the subscription would arm but never deliver a reading`);
+    }
+    this.watched.set(device.device_sn, device);
+    if (this.armIntervalMs > 0) {
+      await this.armAll();
+      if (!this.armTimer) {
+        this.armTimer = setInterval(() => void this.armAll(), this.armIntervalMs);
+        this.armTimer.unref?.();
+      }
+    }
+  }
+  /** Tear down the connection and stop the re-arm timer. */
+  async close() {
+    if (this.armTimer) {
+      clearInterval(this.armTimer);
+      this.armTimer = void 0;
+    }
+    this.watched.clear();
+    await this.transport.disconnect();
+  }
+  /**
+   * Set a Solarbank's display screen-off timeout — publishes the captured cmd-17 command (ff09 msgtype
+   * `0x68`, tag `a5 = [01, index]`) on the device's `…/req` channel via the same envelope the arming
+   * poll uses (`sign_code:1`, no per-message signature — which the device accepts for cmd 17). `index`
+   * is the 1-based dropdown position (10s=1, 20s=2, 30s=3, 1m=4, 5m=5, 30m=6); "Never" is a separate
+   * command not handled here. Fire-and-forget: the device does not ack on a subscribed channel.
+   */
+  async setDisplayTimeout(device, index) {
+    const topic = solixDeviceTopics(this.appName, device.product_code, device.device_sn).req;
+    const body = this.commandEnvelope(device, buildDisplayTimeoutFrame(index), {});
+    await this.transport.publish(topic, body, { qos: 1 });
+    this.logger?.debug?.(`[solix] display timeout set index=${index} on ${device.device_sn}`);
+  }
+  /**
+   * Re-arm every watched device and send the site heartbeat. The device only pushes `param_info` while
+   * a client keeps requesting it — this replays the app's `requestDeviceInfo` (cmd 17) + `power_site`
+   * heartbeat (cmd 10); the request frames are reproduced byte-for-byte by {@link buildFf09Request}
+   * (checksum-verified against captured frames in its spec). Best-effort: a publish failure is emitted,
+   * not thrown, so one bad device doesn't stop the rest or kill the timer.
+   */
+  async armAll() {
+    for (const device of this.watched.values()) {
+      try {
+        await this.arm(device);
+      } catch (e) {
+        this.emit("error", e);
+      }
+    }
+    if (this.userId) {
+      try {
+        await this.transport.publish(solixUserTopics(this.appName, this.userId).powerSite, this.heartbeatEnvelope(), {
+          qos: 1
+        });
+      } catch (e) {
+        this.emit("error", e);
+      }
+    }
+  }
+  /** Publish the device-info arming request (both the "info" and "realtime" ff09 variants the app sends). */
+  async arm(device) {
+    const topic = solixDeviceTopics(this.appName, device.product_code, device.device_sn).req;
+    for (const variant of ["info", "realtime"]) {
+      const body = this.commandEnvelope(device, buildFf09Request(variant), variant === "info" ? { encoding_type: 2 } : {});
+      await this.transport.publish(topic, body, { qos: 1 });
+    }
+    this.logger?.debug?.(`[solix] armed ${device.device_sn} (param_info reporting requested)`);
+  }
+  /** The common `head` fields for every cmd envelope; callers add `cmd` + the per-message variable bits. */
+  makeHead(cmd, extra) {
+    return {
+      version: "1.0.0.1",
+      client_id: this.appClientId,
+      timestamp: Math.floor(Date.now() / 1e3),
+      cmd_status: 2,
+      sign_code: 1,
+      cmd,
+      ...extra
+    };
+  }
+  /**
+   * Build the `{head, payload}` cmd-17 (requestDeviceInfo) envelope carrying a base64 ff09 request.
+   * `account_id` is omitted when the user id is unknown: a live broker cannot tell an empty placeholder
+   * from a real value, so sending `""` would claim an account this client does not have.
+   */
+  commandEnvelope(device, frame, extra) {
+    this.seq += 1;
+    return JSON.stringify({
+      head: this.makeHead(17, {
+        sess_id: genId(),
+        msg_seq: this.seq,
+        seed: genId(),
+        device_pn: device.product_code,
+        device_sn: device.device_sn
+      }),
+      payload: JSON.stringify({
+        device_sn: device.device_sn,
+        ...this.userId ? { account_id: this.userId } : {},
+        data: frame.toString("base64"),
+        ...extra
+      })
+    });
+  }
+  /**
+   * The `power_site` heartbeat (cmd 10) envelope the app sends on a timer to keep the session alive.
+   * `site_id` is omitted when unknown, for the same reason `account_id` is in {@link commandEnvelope}.
+   */
+  heartbeatEnvelope() {
+    return JSON.stringify({
+      head: this.makeHead(10, { sess_id: "1", msg_seq: 1, seed: "1" }),
+      payload: JSON.stringify({ user_id: this.userId ?? "", ...this.siteId ? { site_id: this.siteId } : {} })
+    });
+  }
+  /**
+   * Decode one inbound MQTT message envelope and emit a `reading` if it carries an ff09 param frame. The
+   * product code and the fallback serial come from the topic (`dt/{app}/{pn}/{sn}/param_info`); the frame's
+   * own `a2` field wins for the serial when it carries one.
+   *
+   * Serial resolution matters because NOT every frame carries it: the device-info frame (which alone
+   * carries SOC/temperature via tags a3/a4) has a 1-byte `a2` (a status, not a serial) and can arrive on
+   * a topic whose serial segment isn't the device serial either — leaving a `deviceSn` that matches no
+   * watched device, so a consumer keying on it would drop the reading (and its temperature). So when the
+   * resolved serial isn't a watched device, fall back to the single watched device of this product code.
+   */
+  onMessage(msg) {
+    const topic = msg.topic ?? "";
+    const buf = extractFf09Payload(msg.raw);
+    if (!buf)
+      return;
+    if (topic.endsWith("/req")) {
+      this.handleCommand(topic, buf);
+      return;
+    }
+    const frame = decodeSolixParamFrame(buf);
+    if (!frame)
+      return;
+    const parts = topic.split("/");
+    const productCode = parts[2] ?? "";
+    let deviceSn = frame.deviceSn ?? parts[3] ?? "";
+    if (!this.watched.has(deviceSn)) {
+      const ofProduct = [...this.watched.values()].filter((d) => d.product_code === productCode);
+      if (ofProduct.length === 1)
+        deviceSn = ofProduct[0].device_sn;
+    }
+    const values = topic.endsWith("/state_info") ? solixStateReadings(frame) : (
+      // Pass the product code so meter tag→name binding is applied only to a meter frame; a Solarbank's
+      // tags stay raw channel_<hex> (the model names them per capability) rather than being mislabelled.
+      solixReadings(frame, productCode)
+    );
+    this.emit("reading", { deviceSn, productCode, topic, frame, values });
+  }
+  /**
+   * Turn an app→device cmd-17 (`0x68`) command seen on the `…/req` channel into a `reading` carrying the
+   * app-set control state, so a change made in the app reflects back. The Solarbank's ambient light and
+   * display timeout are set this way (byte-identical to what {@link setDisplayTimeout} publishes), and the
+   * broker copies the app's publish to us as a co-subscriber. Only `0x68` frames carrying `a4`/`a5` are
+   * emitted, so the arming polls (`0x40`/`0x57`) and our own echoes contribute nothing:
+   * - `a4 = [01, s]` → ambient light, INVERTED (`s` 0 = on) → `ambientLightOn` 1/0. The `ba` telemetry
+   *   bit only tracks our `set_device_attrs` write, so this is the ONLY read-back of an app light toggle.
+   * - `a5 = [01, i]` → display timeout, `i` = 1-based dropdown index → `displayTimeoutIndex`.
+   */
+  handleCommand(topic, buf) {
+    if (buf.length < 10 || buf[8] !== 104)
+      return;
+    const frame = decodeSolixParamFrame(buf);
+    if (!frame)
+      return;
+    const values = {};
+    const a4 = frame.fields.get(164);
+    if (a4 && a4.length >= 2)
+      values.ambientLightOn = a4[1] === 0 ? 1 : 0;
+    const a5 = frame.fields.get(165);
+    if (a5 && a5.length >= 2)
+      values.displayTimeoutIndex = a5[1];
+    if (Object.keys(values).length === 0)
+      return;
+    const parts = topic.split("/");
+    const productCode = parts[2] ?? "";
+    let deviceSn = frame.deviceSn ?? parts[3] ?? "";
+    if (!this.watched.has(deviceSn)) {
+      const ofProduct = [...this.watched.values()].filter((d) => d.product_code === productCode);
+      if (ofProduct.length === 1)
+        deviceSn = ofProduct[0].device_sn;
+    }
+    this.emit("reading", { deviceSn, productCode, topic, frame, values });
+  }
+};
+function extractFf09Payload(raw) {
+  if (Buffer.isBuffer(raw))
+    return raw;
+  if (!raw || typeof raw !== "object")
+    return null;
+  const env = raw;
+  let payload = env.payload;
+  if (typeof payload === "string") {
+    try {
+      payload = JSON.parse(payload);
+    } catch {
+      return null;
+    }
+  }
+  const p = payload;
+  const data = p?.data ?? p?.trans ?? env.data;
+  if (typeof data !== "string")
+    return null;
+  const buf = Buffer.from(data, "base64");
+  return buf.length ? buf : null;
+}
+function buildDisplayTimeoutFrame(index) {
+  const body = Buffer.from([3, 0, 15, 0, 104, 161, 1, 34, 165, 2, 1, index & 255]);
+  const frame = Buffer.alloc(body.length + 5);
+  frame[0] = 255;
+  frame[1] = 9;
+  frame.writeUInt16LE(frame.length, 2);
+  body.copy(frame, 4);
+  let xor = 0;
+  for (let i = 0; i < frame.length - 1; i++)
+    xor ^= frame[i];
+  frame[frame.length - 1] = xor;
+  return frame;
+}
+function buildFf09Request(variant, atUnixSec) {
+  const ts = Buffer.alloc(4);
+  ts.writeUInt32LE((atUnixSec ?? Math.floor(Date.now() / 1e3)) >>> 0);
+  const body = variant === "info" ? Buffer.concat([Buffer.from([3, 0, 15, 0, 64, 161, 1, 34, 254, 4]), ts]) : Buffer.concat([
+    Buffer.from([
+      3,
+      0,
+      15,
+      0,
+      87,
+      161,
+      1,
+      34,
+      162,
+      2,
+      1,
+      1,
+      163,
+      3,
+      2,
+      44,
+      1,
+      254,
+      5,
+      3
+    ]),
+    ts
+  ]);
+  const frame = Buffer.alloc(body.length + 5);
+  frame[0] = 255;
+  frame[1] = 9;
+  frame.writeUInt16LE(frame.length, 2);
+  body.copy(frame, 4);
+  let xor = 0;
+  for (let i = 0; i < frame.length - 1; i++)
+    xor ^= frame[i];
+  frame[frame.length - 1] = xor;
+  return frame;
+}
+
 // dist/transport/tuya/index.js
 var tuya_exports = {};
 __export(tuya_exports, {
@@ -25334,6 +27522,7 @@ export {
   CLEAN_EXTENTS,
   CLEAN_FINISH_REASONS,
   CLEAN_PARAMS,
+  CONNECT_TIMEOUT_MS,
   CONTACT_MEMBERS,
   CO_MEMBERS,
   CameraDisabledError,
@@ -25344,6 +27533,7 @@ export {
   CusPushEvent,
   CusPushMode,
   DEFAULT_KEEPALIVE_MS,
+  DISPLAY_MEMBERS,
   DOCK_ACTIVITIES,
   DOCK_KINDS,
   DOORBELL_MEMBERS,
@@ -25397,6 +27587,7 @@ export {
   P256,
   P2PSession,
   P2P_ENVELOPE,
+  P2P_STATION_WAITS,
   PRINTER_CATEGORY_RE,
   PTZ_MEMBERS,
   PowerSource,
@@ -25416,6 +27607,8 @@ export {
   SIREN_MEMBERS,
   SMART_LIGHT_MEMBERS,
   SMOKE_MEMBERS,
+  SOLIX_ENERGY_METER_MEMBERS,
+  SOLIX_LOCAL_KEY_HEX,
   STATE_EVENT_FIELDS,
   STATION_CHANNEL3 as STATION_CHANNEL,
   STATION_CHUNK_BYTES,
@@ -25428,8 +27621,13 @@ export {
   SirenAlarmDuration,
   SirenVolume,
   SmartDropPushEvent,
+  SolixClient,
+  SolixDevice,
+  SolixMqtt,
+  SolixSite,
   StateConvergenceError,
-  StationBusyError,
+  StationKeyUnavailableError,
+  StationUnreachableError,
   StoredSnapshotUnavailableError,
   StreamingQuality,
   SuctionLevel,
@@ -25452,7 +27650,6 @@ export {
   aesKey,
   asBool,
   assertNever,
-  autoContrast,
   bizChannelName,
   buildActions,
   buildAppShapedClientId,
@@ -25460,9 +27657,11 @@ export {
   buildDeviceNameBody,
   buildDirectBinaryBody,
   buildEventIndex,
+  buildModelIndex,
   buildRealtimeInit,
   captureSnapshotFromShared,
   cellAtPoint,
+  claimedParams,
   clamp,
   classify,
   classifyDevice,
@@ -25497,6 +27696,8 @@ export {
   detectCapabilities,
   detectionName,
   discoverReachableInstance,
+  discoverSolixDevices,
+  discoverSolixSites,
   encodeAiDetectType,
   encodeVarint,
   encryptBody,
@@ -25525,6 +27726,9 @@ export {
   isNotAuthorized,
   isPrivateIpv4,
   isSessionValid,
+  isSolixPowerStation,
+  isSolixSmartMeter,
+  isSolixSolarbank,
   isV1Image,
   isV2Image,
   jpegGeometry,
@@ -25534,6 +27738,7 @@ export {
   lz4BlockDecompress,
   mapCellValue,
   mapCellValueAt,
+  md5Hex,
   mergeCandidateIps,
   mergeProperties,
   mqttAppName,
@@ -25578,9 +27783,14 @@ export {
   secureTopic,
   signKey,
   signRequest,
+  solarbankSceneReadings,
+  solixDeviceTopics,
+  solixProductFamily,
+  solixUserTopics,
   structuralEqual,
   subscribeTopics,
   suctionLevelName,
+  tokenNotExpired,
   tuya_exports as tuya,
   u16be,
   u16le,